CVE-2025-46762
Description
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.
How to fix
- apache parquet1.15.2 or later
- org.apache.parquet:parquet-avro1.15.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache parquet | v < 1.15.2 | 1.15.2 |
| org.apache.parquet:parquet-avroMaven | v < 1.15.2 | 1.15.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.