tag
Unsafe-Deserialization
CVE-2025-30065
misc
CRITICAL 9.8
EPSS 41%
Apache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065)
CVE-2025-30065 is an unsafe class-instantiation vulnerability in Apache Parquet Java's parquet-avro module: crafted Avro schema metadata embedded in a Parquet file can force the reading JVM to load and instantiate attacker-named classes. The official 1.15.1…
Patched
2026-07-06
CVE-2025-30065
misc
CRITICAL 10
EPSS 41%
Apache Parquet Java Unsafe Deserialization RCE (CVE-2025-30065)
CVE-2025-30065 is an unsafe deserialization issue in Apache Parquet Java schema handling that can instantiate attacker-controlled classes while parsing malicious Parquet/Avro metadata. The provided PoC demonstrates two practical outcomes: arbitrary command…
Patched
2026-05-16