CVE-2025-30065 is a critical (CVSS 9.8) arbitrary code execution flaw in the parquet-avro module of Apache Parquet Java. It affects versions through 1.15.0 when reading an Avro schema from Parquet file metadata. Apache says to upgrade to 1.15.1, so check your builds and any bundled copies of the library today.
What's affected
Apache Parquet Java through 1.15.0 is affected, specifically the parquet-avro module. The project's announcement says users should upgrade to version 1.15.1, which fixes the issue.
The flaw is in schema parsing. When the library reads an Avro schema from the metadata of a Parquet file, it can be driven to run code. That makes the risk highest for systems that open Parquet files from sources you do not control.
The fix is described in the project pull request titled to restrict trusted packages in the parquet-avro module. The record does not flag the CVE as known exploited, and the Apache announcement does not say it is.
How to check if you're exposed
Parquet is common in data pipelines, so check Java build files and deployed jars.
- For Maven projects, run mvn dependency:tree -Dincludes=org.apache.parquet and look for parquet-avro at 1.15.0 or lower.
- For Gradle projects, run gradle dependencies and search for parquet-avro.
- Look inside shaded or fat jars, Spark and Hadoop distributions and data tools that bundle the library, since they may carry their own copy.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project's dependency list includes an affected component, and the Gold directory lets you look up the CVE and its related weaknesses.
What to do now
- List every application, job and tool that uses parquet-avro, including bundled copies.
- Upgrade parquet-avro and related Parquet Java modules to 1.15.1 or later and rebuild.
- For platforms that bundle the library, check the vendor's guidance and update the platform.
- Until you update, avoid reading Parquet files from untrusted sources with the parquet-avro module.
- Run data processing jobs with limited permissions and network access.
Why it matters
The record maps the flaw to CWE-502 (Deserialization of Untrusted Data). The library reads a schema from file metadata, and that step could create objects that were never meant to be created from file contents. The pull request that fixes it limits which packages are trusted.
The trust boundary is the key point. A data file looks passive, but its metadata drives parsing. If a pipeline ingests files from partners, uploads or the open internet, the file author influences what the library does. That is why untrusted files and rich metadata parsers are a risky mix.
Patching is cheap compared with auditing every file source, so treat the upgrade as the main fix.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Apache Parquet Java 1.15.1, according to the project announcement.
Does it matter where my Parquet files come from?
Yes. Files from sources you do not control make exploitation realistic. Files written only by your own trusted systems carry less risk, but updating is still the safe move.
Sources
Last reviewed: 19 October 2026.
