CVE-2026-73334

Apache Parquet (org.apache.parquet.crypto.keytools package, versions 1.12–1.18 ) is vulnerable to a file-controlled KMS URL issue. During Parquet file decryption, if the application does not explicitly set the KMS URL, the URL embedded in the file is forwarded to the pluggable KmsClient implement...