Security Bulletin: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code, which affects IBM watsonx.data

Summary Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to...

CVE-2025-46762 vulnerabilities

Vulnerabilities for packages: trino...

CVE-2025-46762 vulnerabilities

Vulnerabilities for packages: trino...

CVE-2025-46762

A flaw was found in the Apache Parquet parquet-avro module. This vulnerability allows potential malicious code execution via malicious schema deserialization when using the "specific" or "reflect" Avro data models to read Parquet files. Simply opening or processing a Parquet file could potentiall...

CVE-2025-46762

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be...

CVE-2025-46762

CVE-2025-46762 affects Apache Parquet, specifically the parquet-avro module (versions 1.15.0 and earlier). The issue is a schema parsing flaw that can allow arbitrary code execution when the client uses the specific or reflect models to read Parquet files; the generic model is not affected. Upgra...

CVE-2025-46762 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be...