Detections
Analytics

CVE-2025-30065

critical

Description

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

References

https://news.ycombinator.com/item?id=43603091

https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5

https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java

https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java

https://access.redhat.com/security/cve/CVE-2025-30065

http://www.openwall.com/lists/oss-security/2025/04/01/1

https://www.securityweek.com/critical-vulnerability-found-in-apache-roller-blog-server/

https://thehackernews.com/2025/04/critical-apache-roller-vulnerability.html

https://www.securityweek.com/critical-apache-parquet-vulnerability-leads-to-remote-code-execution/

https://thehackernews.com/2025/04/critical-flaw-in-apache-parquet-allows.html

https://securityaffairs.com/176187/security/apache-parquets-java-library-critical-flaw.html

https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet/

https://www.endorlabs.com/learn/critical-rce-vulnerability-in-apache-parquet-cve-2025-30065---advisory-and-analysis

https://github.com/apache/parquet-java/pull/3169

Details

Source: Mitre, NVD

Published: 2025-04-01

Updated: 2025-07-28

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.00086

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability Being Monitored