CVE-2025-46762 is affecting parquet-avro:1.15.1

CVE-2025-46762:
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses "specific" or the "reflect" model deliberately for reading Parquet files. (the "generic" model is not impacted)Recommended fix:

• Users are recommended to set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1.

This CVE is classified as Severity: 7.1 (high)

External Links:

• CVE-2025-46762 Detail 
• External Control of File Name or Path 
• Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata 

*NOTE: The Engineering Team is already working on addressing this in a future release.