CVE-2025-30065 Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

🗓️ 01 Apr 2025 07:53:42Reported by apacheType

Apache Parquet 1.15.0 allows code execution; upgrade to 1.15.1 to fix the issue.

Reporter	Title	Published	Views	Family All 53
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL	23 Jan 202610:25	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera.	17 Jun 202514:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the parquet-avro module of Apache Parquet (CVE-2025-30065)	30 May 202512:38	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera	21 Aug 202519:56	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera	21 Jul 202515:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to tampering and elevation of privilege (CVE-2025-30065) due to the use of IBM Db2	21 Jul 202523:55	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Parquet vulnerabilities affect watsonx.data	20 Jun 202505:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in Apache Parquet (CVE-2025-30065).	23 Jul 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.	5 Dec 202513:42	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.	18 Jul 202508:11	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "packageName": "org.apache.parquet:parquet-avro",
    "product": "Apache Parquet Java",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.15.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5

01 Apr 2025 07:53Current

CVSS 410

EPSS0.41231

CWE-502