CVE-2025-30065
Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
- Record
CVE-2025-30065- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2025-9322
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
- Record
EUVD-2025-9322- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2c59-37c4-qrx5
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
- Record
GHSA-2c59-37c4-qrx5- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
- Record
CVE-2025-30065- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
- Record
CVE-2025-30065- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-2c59-37c4-qrx5
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
- Record
GHSA-2c59-37c4-qrx5- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.parquet:parquet-avroMaven |
before 1.15.1 | 1.15.1 |
org.apache.parquet:parquet-avroMaven |
before 1.15.1, plus listed versions 1.10.01.10.11.11.01.11.11.11.2 Show 18 moreShow less1.12.01.12.11.12.21.12.31.13.01.13.11.14.01.14.11.14.21.14.31.14.41.15.01.7.01.8.01.8.11.8.21.8.31.9.0 |
1.15.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065 | 2025-04-23 |
| PoC in GitHub | ThreatRadarAI/TRAI-001-Critical-RCE-Vulnerability-in-Apache-Parquet-CVE-2025-30065-Simulation | 2025-04-21 |
| PoC in GitHub | bjornhels/CVE-2025-30065 | 2025-04-04 |
| PoC in GitHub | h3st4k3r/CVE-2025-30065 | 2025-04-04 |
| PoC in GitHub | micrictor/parquet-avro-rce | 2026-04-06 |
| PoC in GitHub | mouadk/parquet-rce-poc-CVE-2025-30065 | 2025-04-07 |
| PoC in GitHub | ron-imperva/CVE-2025-30065-PoC | 2025-04-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30065 is a critical vulnerability (CVSS 10.0) in Apache Parquet Java, published April 1, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 43.6%, the 98th percentile. Fixed in org.apache.parquet:parquet-avro 1.15.1.
References
lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java
openwall.com/lists/oss-security/2025/04/01/1
news.ycombinator.com/item?id=43603091
bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet
Show 8 moreShow less
access.redhat.com/security/cve/CVE-2025-30065
nvd.nist.gov/vuln/detail/CVE-2025-30065
issues.apache.org/jira/browse/AVRO-3985