Encryption Vulnerability in Apache Parquet Affects Data Security

CVE-2026-73334

What is CVE-2026-73334?

The org.apache.parquet.crypto.keytools package in Apache Parquet versions 1.12 through 1.18 poses a risk to users by potentially allowing an attacker to manipulate the Key Management Service (KMS) URL. This could result in sensitive KMS tokens being sent to unauthorized hosts if the application does not validate the KMS URL. Users are encouraged to implement application-controlled KMS URL parameters to mitigate this risk until a fix is introduced in version 1.19, which will disable file-controlled KMS URLs by default.

References