Read the docs
TI-2025-29423 Aliases CVE-2025-46762GHSA-53wx-pr6q-m3j5

Apache Parquet Java: Potential malicious code execution from trusted packages in the…

Priority LOW 37CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0162 76th percentileScored 2026-11-07
Fix Partial org.apache.parquet:parquet-avro (Maven): 1.15.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Parquet Javaup to 1.15.1—No fix listedCNA
—org.apache.parquet:parquet-avro (Maven)before 1.15.21.15.2Patch availableGHSA-53wx-pr6q-m3j5
  • Apache Parquet Java VendorApache Affected up to 1.15.1 Fixed in — No fix listed CNA
  • org.apache.parquet:parquet-avro (Maven) Vendor— Affected before 1.15.2 Fixed in 1.15.2 Patch available GHSA-53wx-pr6q-m3j5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:parquet:*:*:*:*:*:*:*:*before 1.15.2VulnerableApache
  • cpe:2.3:a:apache:parquet:*:*:*:*:*:*:*:* Versions before 1.15.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-53wx-pr6q-m3j5 org.apache.parquet:parquet-avro (Maven) Fixed in 1.15.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46762
  2. 2026-10-03 Alias added: GHSA-53wx-pr6q-m3j5

References

Advisory 2

Other 3

  • TI-2026-51454 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences