CVE-2026-73334VulnerabilityPublished 09/09/2026Updated 09/10/2026

CVE-2026-73334: CWE-20 Improper Input Validation in Apache Software Foundation Apache Parquet Hadoop

Affects Apache Software Foundation Apache Parquet HadoopSource CVE Database V5

ghsa-wrx6-qm3h-c589

Not known to be exploited · CVSS 8.1 High · fixed in 1.19 : patch Apache Software Foundation Apache Parquet Hadoop soon.

Data as of 10/25/2026, 04:40:14 UTC

CVSS 3.1 base score

8.1High

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.19

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
Apache Software FoundationApache Parquet Hadoop	Affected >=1.12 <=1.18.0	Fixed in–
MavenApache Software Foundation/org.apache.parquet.crypto.keytools:parquet-hadoop`pkg:maven/Apache Software Foundation/org.apache.parquet.crypto.keytools:parquet-hadoop`Other threats	Affected >=1.12 <=1.18.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Currently, users should enforce application control over the KMS URL parameter in readers for affected versions (1.12 to 1.18) to prevent file-controlled KMS URLs from being used. The vulnerability is expected to be fixed in version 1.19, which will disable file-controlled KMS URLs by default. After upgrading, users can either continue to enforce application control or explicitly enable file-controlled KMS URLs with required validation and authentication as documented.

Description

CVE-2026-73334 is a high-severity vulnerability in Apache Parquet Hadoop versions 1.12 through 1.18. It involves improper input validation in the org.apache.parquet.crypto.keytools package, which handles encryption of Parquet files using envelope encryption with a Key Management Service (KMS). The vulnerability arises when the KMS URL parameter is controlled by the file rather than the application, potentially allowing a malicious file to direct KMS tokens to an attacker-controlled host. Users are advised to enforce application control over the KMS URL parameter until the issue is fixed in a future release (presumably version 1.19), which will disable file-controlled KMS URLs by default and require explicit validation and authentication if enabled.

Impact

If exploited, this vulnerability could allow an attacker to redirect KMS tokens to a malicious host, potentially compromising the confidentiality and integrity of encrypted Parquet data. The CVSS score of 8.1 indicates high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. Availability is not impacted.

Summary

This vulnerability affects the org.apache.parquet.crypto.keytools package in Apache Parquet Hadoop versions 1.12 to 1.18. The package supports envelope encryption by wrapping data keys via a KMS. The issue occurs because the KMS URL parameter can be controlled by the file rather than the application, and if the pluggable KmsClient implementation does not validate the host, a KMS token may be sent to a malicious host specified by an attacker in the file. The recommended mitigation before patching is to enforce application control of the KMS URL parameter. The fix, expected in version 1.19, will disable file-controlled KMS URLs by default and require explicit validation and authentication for any enabled file-controlled KMS URL usage.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Attack Surface Reduction
Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of…
Architecture and Design · Libraries or Frameworks
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Buffer Overflow via Environment Variables (opens in a new tab)
Server Side Include (SSI) Injection (opens in a new tab)
Cross Zone Scripting (opens in a new tab)
Command Line Execution through SQL Injection (opens in a new tab)
Object Relational Mapping Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…