Threats tagged 'ghsa-wrx6-qm3h-c589'

CVE-2026-73334 is a high-severity vulnerability in Apache Parquet Hadoop versions 1.12 through 1.18. It involves improper input validation in the org.apache.parquet.crypto.keytools package, which handles encryption of Parquet files using envelope encryption with a Key Management Service (KMS). The vulnerability arises when the KMS URL parameter is controlled by the file rather than the application, potentially allowing a malicious file to direct KMS tokens to an attacker-controlled host. Users are advised to enforce application control over the KMS URL parameter until the issue is fixed in a future release (presumably version 1.19), which will disable file-controlled KMS URLs by default and require explicit validation and authentication if enabled.