CVE-2021-41561: Apache Parquet-MR potential DoS in case of malicious Parquet file

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-20 · updated 2026-06-17
Weakness: CWE-20

Description

Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.

Affected products

Apache Software Foundation Apache Parquet: before 1.11.2; from 1.12.0 before 1.12.2 — fixed in 1.11.2, 1.12.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Parquet 1.11.2, 1.12.2. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2021/12/20/1
https://lists.apache.org/thread/1bjlscbqtfzl160hrm9lnpjpppp5z3zr
http://www.openwall.com/lists/oss-security/2021/12/20/1
https://lists.apache.org/thread/1bjlscbqtfzl160hrm9lnpjpppp5z3zr

Get alerted when CVE-2021-41561 or the next vulnerability affects your stack