A most severity distant code execution (RCE) vulnerability has been found impacting all variations of Apache Parquet as much as and together with 1.15.0.
The issue stems from the deserialization of untrusted knowledge that might enable attackers with specifically crafted Parquet information to realize management of goal programs, exfiltrate or modify knowledge, disrupt companies, or introduce harmful payloads comparable to ransomware.
The vulnerability is tracked underneath CVE-2025-30065 and has a CVSS v4 rating of 10.0. The flaw was mounted with the discharge of Apache model 1.15.1.
It must be famous that to use this flaw, risk actors should persuade somebody to import a specifically crafted Parquet file.
Extreme risk to “huge knowledge” environments
Apache Parquet is an open-source, columnar storage format designed for environment friendly knowledge processing. Not like row-based codecs (like CSV), Parquet shops knowledge by columns, which makes it sooner and extra space-efficient for analytical workloads.
It’s extensively adopted throughout the info engineering and analytics ecosystem, together with huge knowledge platforms like Hadoop, AWS, Amazon, Google, and Azure cloud companies, knowledge lakes, and ETL instruments.
Some giant firms that use Parquet embrace Netflix, Uber, Airbnb, and LinkedIn.
The safety downside in Parquet was disclosed on April 1, 2025, following a accountable disclosure by its finder, Amazon researcher Keyi Li.
“Schema parsing within the parquet-avro module of Apache Parquet 1.15.0 and former variations permits unhealthy actors to execute arbitrary code,” warned the quick bulletin revealed on Openwall.
“Customers are really helpful to improve to model 1.15.1, which fixes the problem.”
A separate bulletin by Endor Labs highlights the danger of CVE-2025-30065 exploitation extra clearly, warning that the flaw can impression any knowledge pipelines and analytics programs that import Parquet information, with the danger being vital for information sourced from exterior factors.
Endor Labs believes the issue was launched in Parquet model 1.8.0, although older releases may additionally be impacted. The agency suggests coordinated checks with builders and distributors to find out what Praquet variations are utilized in manufacturing software program stacks.
“If an attacker methods a weak system into studying a specifically crafted Parquet file, they might achieve distant code execution (RCE) on that system,” warns Endor Labs.
Nevertheless, the safety agency avoids over-inflating the danger by together with the be aware, “Regardless of the scary potential, it is necessary to notice that the vulnerability can solely be exploited if a malicious Parquet file is imported.”
That being stated, if upgrading to Apache Parquet 1.15.1 instantly is unimaginable, it’s urged to keep away from untrusted Parquet information or rigorously validate their security earlier than processing them. Additionally, monitoring and logging on programs that deal with Parquet processing must be elevated.
Though no energetic exploitation has been found but, the danger is excessive as a result of flaw’s severity and the widespread use of Parquet information in huge knowledge purposes.
Directors of impacted programs are really helpful to improve to Parquet model 1.15.1, which addresses CVE-2025-30065, as quickly as attainable.
Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and methods to defend towards them.
