Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

CVE-2025-30065 · Published Apr 1, 2025 · updated Sep 10, 2026

Critical

Fix: upgrade to 1.15.1 or later

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code

Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Affected versions

Package	Affected	Fixed in
org.apache.parquet:parquet-avro Maven	< 1.15.1	1.15.1

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A
Severity from: GitHub (reviewed advisory)
Weakness: CWE-502
Also known as: CVE-2025-30065