org.apache.parquet.crypto.keytools vulnerabilities

Products

• org.apache.parquet.crypto.keytools/parquet-hadoop 1

Latest org.apache.parquet.crypto.keytools CVEs

Newest publication first

1. CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

   Published 2026-09-09

   High·CVSS 8.1 EPSS 0.36%

   Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.