cve.bz

CVE-2025-30065

10.0 criticalEPSS 44%

Critical (10.0) in apache parquet java. EPSS 44% chance of exploitation in the next 30 days. Fixed in org.apache.parquet:parquet-avro 1.15.1.

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Severity

CVSS 4.0

10.0 critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
44% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2c59-37c4-qrx5Mavenorg.apache.parquet:parquet-avro<1.15.11.15.1

References

Check your stackJSON