CVE-2026-73334

The org.apache.parquet.crypto.keytools package in Apache Parquet (versions 1.12 to 1.18) is vulnerable to a Server-side Request Forgery (SSRF) due to a host validation bypass. When the KMS URL is file-controlled rather than application-controlled, the FileKeyUnwrapper forwards the URL to a plugga...

PT-2026-88925

Name of the Vulnerable Software and Affected Versions Apache Parquet versions 1.12 through 1.18 Description The org.apache.parquet.crypto.keytools package allows for the encryption of Parquet files using an envelope encryption mechanism that wraps data keys via a Key Management Service KMS. When...