Host Validation Bypass

Apache Parquet is vulnerable to host validation bypass. The vulnerability is due to the pluggable KmsClient implementation not performing host validation for a file‑controlled KMS URL, where the URL from the Parquet file is forwarded without checks and a malicious actor can inject a hostile host,...