CVE-2025-30065
NoneApache Parquet Avro Module Vulnerable to Arbitrary Code Execution
CVSS
—
EPSS
43.6%
Published
Apr 1, 2025
CISA due date
—
The record
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.parquet:parquet-avro | 0 | 1.15.1 |
| Chainguard | druid | 0 | 32.0.1-r2 |
| Chainguard | druid-compat | 0 | 32.0.1-r2 |
| Wolfi | druid | 0 | 32.0.1-r2 |
| Wolfi | druid-compat | 0 | 32.0.1-r2 |
Related vulnerabilities
- CVE-2026-33871 Netty is an asynchronous, event-driven network application framework. Also affects druid
- CVE-2026-33870 Netty is an asynchronous, event-driven network application framework. Also affects druid
- CVE-2026-24308 Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4… Also affects druid
- CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a… Also affects druid
- CVE-2025-59059 Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache… Also affects druid
- CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro… Also affects druid
- CVE-2026-1002 The Vert.x Web static handler component cache can be manipulated to deny the access to… Also affects druid
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects druid