Vulnerability in Apache Parquet
CVE-2025-46762
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.
EPSS: 0.015 (71.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2025-46762?
- CVE-2025-46762 is a high-severity vulnerability in Apache Parquet, classified under External Control of File Name or Path. CVSS score: 8.1/10. Published 2025-05-06.
- How severe is CVE-2025-46762?
- High severity. CVSS v3 base score is 8.1 out of 10.