https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Ivanti patches Connect Secure zero-day exploited since mid-March Ivanti patches Connect Secure zero-day exploited since mid-March + Hunters International shifts from ransomware to pure data extortion Hunters International shifts from ransomware to pure data extortion + WinRAR flaw bypasses Windows Mark of the Web security alerts WinRAR flaw bypasses Windows Mark of the Web security alerts + Australian pension funds hit by wave of credential stuffing attacks Australian pension funds hit by wave of credential stuffing attacks + E-ZPass toll payment texts return in massive phishing wave E-ZPass toll payment texts return in massive phishing wave + OpenAI tests watermarking for ChatGPT-4o Image Generation model OpenAI tests watermarking for ChatGPT-4o Image Generation model + Carding tool abusing WooCommerce API downloaded 34K times on PyPI Carding tool abusing WooCommerce API downloaded 34K times on PyPI + Get help in the stock market with this AI-powered stock platform deal Get help in the stock market with this AI-powered stock platform deal * Tutorials + Latest + Popular + How to access the Dark Web using the Tor Browser How to access the Dark Web using the Tor Browser + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Max severity RCE flaw discovered in widely used Apache Parquet * * Max severity RCE flaw discovered in widely used Apache Parquet By Bill Toulas * April 3, 2025 * 05:29 PM * 0 Apache A maximum severity remote code execution (RCE) vulnerability has been discovered impacting all versions of Apache Parquet up to and including 1.15.0. The problem stems from the deserialization of untrusted data that could allow attackers with specially crafted Parquet files to gain control of target systems, exfiltrate or modify data, disrupt services, or introduce dangerous payloads such as ransomware. The vulnerability is tracked under CVE-2025-30065 and has a CVSS v4 score of 10.0. The flaw was fixed with the release of Apache version 1.15.1. It should be noted that to exploit this flaw, threat actors must convince someone to import a specially crafted Parquet file. Severe threat to "big data" environments Apache Parquet is an open-source, columnar storage format designed for efficient data processing. Unlike row-based formats (like CSV), Parquet stores data by columns, which makes it faster and more space-efficient for analytical workloads. It is widely adopted across the data engineering and analytics ecosystem, including big data platforms like Hadoop, AWS, Amazon, Google, and Azure cloud services, data lakes, and ETL tools. Some large companies that use Parquet include Netflix, Uber, Airbnb, and LinkedIn. The security problem in Parquet was disclosed on April 1, 2025, following a responsible disclosure by its finder, Amazon researcher Keyi Li. "Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code," warned the short bulletin published on Openwall. "Users are recommended to upgrade to version 1.15.1, which fixes the issue." A separate bulletin by Endor Labs highlights the risk of CVE-2025-30065 exploitation more clearly, warning that the flaw can impact any data pipelines and analytics systems that import Parquet files, with the risk being significant for files sourced from external points. Endor Labs believes the problem was introduced in Parquet version 1.8.0, though older releases might also be impacted. The firm suggests coordinated checks with developers and vendors to determine what Praquet versions are used in production software stacks. "If an attacker tricks a vulnerable system into reading a specially crafted Parquet file, they could gain remote code execution (RCE) on that system," warns Endor Labs. However, the security firm avoids over-inflating the risk by including the note, "Despite the frightening potential, it's important to note that the vulnerability can only be exploited if a malicious Parquet file is imported." That being said, if upgrading to Apache Parquet 1.15.1 immediately is impossible, it is suggested to avoid untrusted Parquet files or carefully validate their safety before processing them. Also, monitoring and logging on systems that handle Parquet processing should be increased. Although no active exploitation has been discovered yet, the risk is high due to the flaw's severity and the widespread use of Parquet files in big data applications. Administrators of impacted systems are recommended to upgrade to Parquet version 1.15.1, which addresses CVE-2025-30065, as soon as possible. Red Report 2025 Top 10 MITRE ATT&CK^(c) Techniques Behind 93% of Attacks Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them. Read the Red Report 2025 Related Articles: Critical RCE flaw in Apache Tomcat actively exploited in attacks WordPress security plugin WP Ghost vulnerable to remote code execution bug Critical PHP RCE vulnerability mass exploited in new attacks Ivanti fixes three critical flaws in Connect Secure & Policy Secure Over 12,000 KerioControl firewalls exposed to exploited RCE flaw * Apache * Apache Parquet * Big Data * RCE * Remote Code Execution * Vulnerability * * * * * Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * Oracle Oracle privately confirms Cloud breach to customers * CISA CISA warns of Fast Flux DNS evasion used by cybercrime gangs * Hacker Hunters International shifts from ransomware to pure data extortion Sponsor Posts * Acronis Threat Research Unit: Your secret weapon against Cyber Attacks. Access the reports now Acronis Threat Research Unit: Your secret weapon against Cyber Attacks. Access the reports now * Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free * Hacking security Cybersecurity Interested in changing your approach to penetration tests? * Microsoft 365 Acronis Threat Research Unit: Your secret weapon against Cyber Attacks. Access the reports now * Are Your Security Controls Working Right Now? Put Them to The Test with OnDefend's Validation Services. Are Your Security Controls Working Right Now? Put Them to The Test with OnDefend's Validation Services. [Picus-300x] Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT