The vulnerability of the parquet-avro module for columnar data storage in Apache Parquet Java allows a attacker to execute arbitrary code.

🗓️ 09 Apr 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Parquet-avro vulnerability in Apache Parquet Java allows arbitrary code execution via deserialization.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL	23 Jan 202610:25	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera.	17 Jun 202514:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the parquet-avro module of Apache Parquet (CVE-2025-30065)	30 May 202512:38	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera	21 Aug 202519:56	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera	21 Jul 202515:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to tampering and elevation of privilege (CVE-2025-30065) due to the use of IBM Db2	21 Jul 202523:55	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet vulnerabilities affect watsonx.data	20 Jun 202505:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in Apache Parquet (CVE-2025-30065).	23 Jul 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.	5 Dec 202513:42	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.	18 Jul 202508:11	–	ibm

Vulners

Node

apache parquet_javaRange<1.15.1

Source	Link
openwall	www.openwall.com/lists/oss-security/2025/04/01/1
access	www.access.redhat.com/security/cve/CVE-2025-30065
github	www.github.com/apache/parquet-java/pull/3169
lists	www.lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
news	www.news.ycombinator.com/item
bleepingcomputer	www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet/
github	www.github.com/ron-imperva/CVE-2025-30065-PoC
f5	www.f5.com/labs/articles/threat-intelligence/canary-exploit-tool-for-cve-2025-30065-apache-parquet-avro-vulnerability
web	www.web.nvd.nist.gov/view/vuln/detail

07 May 2025 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 210

CVSS 310

EPSS0.38701

Parquet Avro Apache Parquet Java Deserialization flaw Arbitrary code execution Code execution