Update dependency org.apache.parquet:parquet-avro to v1.15.2 [SECURITY] (master)

[renovatebot-confluentinc]

For any questions/concerns about this PR, please review the Renovate Bot wiki/FAQs, or the #renovatebot Slack channel.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.apache.parquet:parquet-avro (source)	1.10.1 -> 1.15.2

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

CVE-2025-30065 / GHSA-2c59-37c4-qrx5

More information

Details

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code

Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-30065
• https://github.com/apache/parquet-java/issues/3168
• https://github.com/apache/parquet-java/pull/3169
• https://access.redhat.com/security/cve/CVE-2025-30065
• https://github.com/apache/parquet-java
• https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.java
• https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065/blob/main/src/main/java/com/evil/GenerateMaliciousParquetSSRF.java
• https://issues.apache.org/jira/browse/AVRO-3985
• https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
• https://news.ycombinator.com/item?id=43603091
• https://www.bleepingcomputer.com/news/security/max-severity-rce-flaw-discovered-in-widely-used-apache-parquet
• http://www.openwall.com/lists/oss-security/2025/04/01/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

CVE-2025-46762 / GHSA-53wx-pr6q-m3j5

More information

Details

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code.

While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed.

The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted)

Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:N/RE:M/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-46762
• https://github.com/apache/parquet-java
• https://issues.apache.org/jira/browse/AVRO-3985
• https://lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp
• http://www.openwall.com/lists/oss-security/2025/05/02/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[service-bot-app]

Could not automerge PR: CI checks have not passed