[Bug]: Security vulnerability in parquet serialization and deserialization

[iamadhee]

What happened?

Recently a maximum severity vulnerability has been found in the apache parquet module of versions 1.15.0 and below. The vulnerability has been listed already in NVD. Attaching the link below:
https://nvd.nist.gov/vuln/detail/CVE-2025-30065#VulnChangeHistorySection

Issue Priority

Priority: 0 (outage / urgent vulnerability)

Issue Components

• Component: Python SDK
• Component: Java SDK
• Component: Go SDK
• Component: Typescript SDK
• Component: IO connector
• Component: Beam YAML
• Component: Beam examples
• Component: Beam playground
• Component: Beam katas
• Component: Website
• Component: Infrastructure
• Component: Spark Runner
• Component: Flink Runner
• Component: Samza Runner
• Component: Twister2 Runner
• Component: Hazelcast Jet Runner
• Component: Google Cloud Dataflow Runner

[iamadhee]

I use Java SDK version 2.63.0. My parquets are getting written with the below versioning:

  created_by: parquet-mr version 1.13.1 (build db4183109d5b734ec5930d870cdae161e408ddba)
  num_columns: 10
  num_rows: 2
  num_row_groups: 1
  format_version: 1.0
  serialized_size: 3189

[ahmedabu98]

Thanks for opening this @iamadhee, we updated our parquet versions to 1.15.1 in #34573

[ahmedabu98]

Should be available in the next Beam release 2.65.0