CVE-2026-73334

Apache Parquet (org.apache.parquet.crypto.keytools package, versions 1.12–1.18 ) is vulnerable to a file-controlled KMS URL issue. During Parquet file decryption, if the application does not explicitly set the KMS URL, the URL embedded in the file is forwarded to the pluggable KmsClient implement...

EUVD-2026-74804

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...