CVE-2025-30065

🗓️ 01 Apr 2025 07:53:42Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 1824 Views

CVE-2025-30065 in Apache Parquet allows arbitrary code execution via parquet-avro module; upgrade recommended.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL	23 Jan 202610:25	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera.	17 Jun 202514:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the parquet-avro module of Apache Parquet (CVE-2025-30065)	30 May 202512:38	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera	21 Aug 202519:56	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera	21 Jul 202515:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to tampering and elevation of privilege (CVE-2025-30065) due to the use of IBM Db2	21 Jul 202523:55	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet vulnerabilities affect watsonx.data	20 Jun 202505:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in Apache Parquet (CVE-2025-30065).	23 Jul 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.	5 Dec 202513:42	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.	18 Jul 202508:11	–	ibm

NVD

Vulners

Node

apache parquet_javaRange<1.15.1

[
  {
    "defaultStatus": "unaffected",
    "packageName": "org.apache.parquet:parquet-avro",
    "product": "Apache Parquet Java",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.15.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
github	www.github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java
openwall	www.openwall.com/lists/oss-security/2025/04/01/1
bleepingcomputer	www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet/
access	www.access.redhat.com/security/cve/CVE-2025-30065
news	www.news.ycombinator.com/item
github	www.github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java
github	www.github.com/apache/parquet-java/pull/3169

28 Jul 2025 14:23Current

7.8High risk

Vulners AI Score7.8

CVSS 3.19.8

CVSS 410

EPSS0.00419

SSVC

CWE-502

cve-2025-30065 apache parquet arbitrary code execution schema parsing upgrade recommended