9 matches found
parquet-rce-poc-CVE-2025-30065
CVE-2025-30065 This repository illustrates how to exploit CVE-2025-30065 and achieve remote class instantiation and trigger a network request from within the victim application i.e the JVM thereby achieving SSRF. The generated parquet in Malicious.java assumes that the class RCEPayload.java is...
CVE-2025-30065
💥 CVE-2025-30065 - Parquet Deserialization PoC This project demonstrates a safe proof-of-concept for CVE-2025-30065 using Apache Parquet and Java deserialization. When a Parquet file containing a serialized Java object is read, the payload executes a visible command to prove code execution. 📦 Usa...
CVE-2025-30065-PoC
CVE-2025-30065 PoC Usage Build the image docker build -t cve-2025-30065 . Generate the malicious Parquet docker run --rm -v $pwd:/poc/out cve-2025-30065 generate "cat /etc/passwd" ./out/malicious.parquet Trigger the exploit docker run --rm -v $pwd:/poc/out cve-2025-30065 trigger...
External Control of System or Configuration Setting
Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the GetKmsClientFromConfigOrKeyMaterial function, which falls back to the KMS URL embedded in a Parquet file's key material when KmsConnectionConfig does not specify one, and forwar...
CVE-2026-73334
A flaw was found in Apache Parquet Hadoop. When processing a Parquet file, if the Key Management Service KMS Uniform Resource Locator URL is controlled by the file and not explicitly set by the application, a vulnerability can arise. An attacker could craft a malicious Parquet file to direct a KM...
CVE-2026-42241 ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this...
GHSA-MW35-8RX3-XF9R Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Ray Data registers custom Arrow extension types ray.data.arrowtensor, ray.data.arrowtensorv2, ray.data.arrowvariableshapedtensor globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls arrowextdeserialize on the field's metadata bytes. Ray's...
GHSA-53WX-PR6Q-M3J5 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be...
