{"id":"CVE-2026-42241","aliases":["EUVD-2026-28430","GHSA-rrjr-v56m-ww88"],"status":"published","title":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00273,"percentile":0.1979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-04-24T16:39:55Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"NuGet","package":"ParquetSharp","fixed_in":["23.0.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"ParquetSharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.1.0"},{"fixed":"23.0.0.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"ParquetSharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.1.0"},{"fixed":"23.0.0.1"}]}],"versions":["18.1.0","19.0.1","19.0.1-beta1","20.0.0","20.0.0-beta1","20.0.0-beta2","21.0.0","21.0.0-beta1","23.0.0","23.0.0-beta1"]}],"products":[{"vendor":"g-research","product":"parquetsharp"}],"references":[{"url":"https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42241","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rrjr-v56m-ww88"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42241.json","tags":["advisory"]},{"url":"https://github.com/G-Research/ParquetSharp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42241","title":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","status":"published","published":"2026-05-07T18:52:06.773Z","modified":"2026-05-08T21:30:27.11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-28430","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","status":"published","published":"2026-05-07T18:52:06Z","modified":"2026-05-08T21:30:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:14.089367Z"}],"ghsa":[{"id":"GHSA-rrjr-v56m-ww88","title":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","description":"`DecimalConverter.ReadDecimal` makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.\n\nThis affects applications using ParquetSharp to read untrusted Parquet files in a network service.","status":"published","published":"2026-04-24T16:39:55Z","modified":"2026-05-11T13:29:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-42241","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","status":"published","published":"2026-05-07T20:16:44.247Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-42241","title":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","status":"published","published":"2026-05-07T18:52:06.773Z","modified":"2026-10-28T02:31:12.716011533Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-rrjr-v56m-ww88","title":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","description":"`DecimalConverter.ReadDecimal` makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.\n\nThis affects applications using ParquetSharp to read untrusted Parquet files in a network service.","status":"published","published":"2026-04-24T16:39:55Z","modified":"2026-05-11T13:53:07.100127Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}