CVE-2025-30065

Katalog CVE

CVSS 9.8 · Critical EPSS 43,6%

Kerentanan Deserialization of Untrusted Data pada apache parquet java. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Rincian

Terbit di NVD

1 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

43,6% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apache/parquet-java/pull/3169 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2025/04/01/1 mailing list · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-30065 issue tracking · advisory pihak ketiga
• https://news.ycombinator.com/item?id=43603091 issue tracking · advisory pihak ketiga
• https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet/ exploit · press/media coverage · advisory pihak ketiga
• https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java advisory pihak ketiga
• https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousPar... advisory pihak ketiga
• https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5 mailing list · release notes