Read the docs
TI-2021-18298 Aliases CVE-2021-41561GHSA-gc67-crq6-hgh5

Apache Parquet-MR potential DoS in case of malicious Parquet file

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.

Why it matters now

EPSS 0.03152 88th percentileScored 2026-11-07
Fix Fixed org.apache.parquet:parquet (Maven): 1.12.2, 1.11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Parquet1.9.0 and later—No fix listedCNA
—org.apache.parquet:parquet (Maven)1.12.0 to before 1.12.21.12.2Patch availableGHSA-gc67-crq6-hgh5
—org.apache.parquet:parquet (Maven)before 1.11.21.11.2Patch availableGHSA-gc67-crq6-hgh5
  • Apache Parquet VendorApache Affected 1.9.0 and later Fixed in — No fix listed CNA
  • org.apache.parquet:parquet (Maven) Vendor— Affected 1.12.0 to before 1.12.2 Fixed in 1.12.2 Patch available GHSA-gc67-crq6-hgh5
  • org.apache.parquet:parquet (Maven) Vendor— Affected before 1.11.2 Fixed in 1.11.2 Patch available GHSA-gc67-crq6-hgh5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:parquet_java:*:*:*:*:*:*:*:*before 1.11.2; 1.12.0 to before 1.12.2VulnerableApache
  • cpe:2.3:a:apache:parquet_java:*:*:*:*:*:*:*:* Versions before 1.11.2; 1.12.0 to before 1.12.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-gc67-crq6-hgh5 org.apache.parquet:parquet (Maven) Fixed in 1.12.2 Advisory →
  • Fix · GHSA-gc67-crq6-hgh5 org.apache.parquet:parquet (Maven) Fixed in 1.11.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41561
  2. 2026-10-03 Alias added: GHSA-gc67-crq6-hgh5

References

Advisory 3

Other 1

  • TI-2025-21426 Deserialization of untrusted data in Apache Parquet Java CVSS 4.0CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences