Severe Java-Based Exploit Uncovered in Apache Parquet Puts Big Data Systems at Risk
A newly revealed high-risk flaw in Apache Parquet’s Java implementation could expose data infrastructure to remote code execution (RCE) attacks via tampered Parquet files.
Cataloged as CVE-2025-46762, the vulnerability affects every version of Apache Parquet Java up to and including 1.15.1. Apache Parquet serves as a foundational component in many analytics platforms, facilitating compact, high-performance data storage. Its integration with tools such as Apache Hadoop, Spark, and Flink makes this exposure particularly widespread.
Weakness Within the Parquet-Avro Integration
The issue originates in the parquet-avro module, which is responsible for interpreting Avro schema metadata within Parquet files. While version 1.15.1 of Parquet attempted to introduce a safer handling mechanism by limiting deserialization to “trusted” Java packages, the default configuration remains dangerously permissive. This loophole allows attacker-controlled classes to slip through during deserialization.
According to a security bulletin from the Apache Software Foundation, earlier versions — including 1.15.0 and below — permit execution of malicious classes embedded in schema metadata. Even with the patch, the failure to enforce restrictive defaults means systems remain exploitable unless manually hardened.
Specific Attack Vector: Deserialization Models
The attack vector impacts applications using the “specific” or “reflect” Avro data models when reading Parquet files. Those using the “generic” model are not affected. This distinction is critical for data engineers and architects configuring ingest pipelines, especially in environments where files may originate from third-party or unverified sources.
The flaw opens the door to arbitrary code execution during schema deserialization, a severe class of vulnerability in Java applications handling serialized data.
Echoes of a Pattern in Serialization Attacks
This incident mirrors the earlier CVE-2025-30065 vulnerability disclosed in April 2025, which also stemmed from unsafe deserialization practices in the parquet-avro layer.
The security issue was responsibly disclosed by researchers Andrew Pikler, David Handermann, and Nándor Kollár, who continue to spotlight serialization threats in widely used open-source libraries.
Mitigation Steps
Users of Apache Parquet Java are urged to upgrade to version 1.15.1 or later and explicitly configure trusted package restrictions to block unauthorized class loading. Additionally, teams should audit any pipelines that consume Parquet files from external or user-submitted sources.
Risk Summary
| Category | Information |
|---|---|
| Impacted Software | Apache Parquet Java (up to and including version 1.15.1), specifically the parquet-avro module. |
| Severity | Critical – Exploitable for arbitrary code execution. |
| Attack Requirements | – Application is using Apache Parquet Java ≤ 1.15.1– Utilizes the parquet-avro module– Employs the “specific” or “reflect” Avro models– Attacker delivers a specially crafted Parquet file containing a malicious Avro schema |
| CVSS v3.1 Rating | Critical |
Urgent Mitigation Required for Apache Parquet Java Vulnerability
Enterprises relying on vulnerable versions of Apache Parquet Java should prioritize remediation without delay to protect their data processing environments.
To eliminate exposure, the Apache Parquet project released version 1.15.2 on May 1, 2025, which definitively resolves the security flaw.
Recommended Mitigation Paths:
- Preferred Solution
Upgrade to Apache Parquet Java 1.15.2, which includes all necessary security patches and enhanced safeguards against the discovered exploit. - Interim Workaround (for 1.15.1 users only)
If an immediate upgrade is not feasible, apply the following configuration hardening:
Set the system property:
ini
org.apache.parquet.avro.SERIALIZABLE_PACKAGES=””
- This disables deserialization of external packages, significantly reducing attack surface until a full upgrade can be completed.
Organizations processing untrusted Parquet files or operating in externally exposed environments should consider this issue high priority.
Mitigation Strategies Effectively Neutralize the Threat
Implementing either of the recommended solutions blocks the underlying exploit mechanism by eliminating the risk of executing harmful code through overly permissive package trust settings.
Organizations leveraging Apache Parquet in their analytics or processing pipelines should conduct a prompt security review of their environments and apply corrective measures without delay to safeguard against potential attacks.
