Apache Parquet Java vulnerabilities

2 CVEs affecting Apache Parquet Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30065, published 2025-04-01.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-30065, published 2025-04-01. Critical severity, CVSS 9.8. EPSS: 43.6% chance of exploitation in the next 30 days. Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes…
• CVE-2021-41561, published 2021-12-20. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.