CVE-2026-42241
Medium
Description
ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.
SeverityMedium
CVSS5.3
Exploit probability—
ProductParquetsharp
PublishedMay 7, 2026
First seenMay 7, 2026
Weakness typeCWE-789CWE-789
How to fix
Update
- ParquetSharp23.0.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ParquetSharpNuGet | 18.1.0 ≤ v < 23.0.0.1 | 23.0.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.