Deserialization of Untrusted Data in Apache Parquet Java - CVE-2025-30065

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU106977

Deserialization of Untrusted Data in Apache Parquet Java - CVE-2025-30065

Published: April 4, 2025 / Updated: July 18, 2025


Vulnerability identifier: #VU106977
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-30065
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the parquet-avro module when parsing an Avro schema from a Parquet file metadata. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Apache Parquet Java
Oracle NoSQL Database
IBM DB2
IBM InfoSphere Information Server
watsonx.data
IBM Cloud Pak System
Cloudera Observability with IBM
Oracle Business Intelligence Enterprise Edition
Db2 Big SQL
IBM OpenPages with Watson
IBM Cloud Application Performance Management (APM)

How to mitigate CVE-2025-30065

Install updates from vendor's website.

Apache Parquet Java - update to 1.15.1
watsonx.data - update to 2.2
IBM Cloud Pak System - update to 2.3.6.0
Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
IBM DB2 - addressed in versions 11.1.4 FP7, 11.5.9, 12.1.1
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 6

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins