We use cookies to improve your experience on our site.
AVID-2026-R0919
Description
Apache Parquet-MR potential DoS in case of malicious Parquet file (CVE-2021-41561)
Details
Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.
Reason for inclusion in AVID: CVE-2021-41561 describes an improper input validation vulnerability in Apache Parquet-MR that can cause denial of service when processing a malicious Parquet file. Parquet is a common data format and is widely used in AI/ML data pipelines for training and inference. Therefore, this vulnerability affects software components (Parquet libraries) used to build and run general-purpose AI systems, constitutes a security vulnerability (DoS), and is evidenced by the CVE description and references. Suitable for AVID curation as a software supply chain issue in AI stacks.
References
- NVD entry
- https://lists.apache.org/thread/1bjlscbqtfzl160hrm9lnpjpppp5z3zr
- http://www.openwall.com/lists/oss-security/2021/12/20/1
Affected or Relevant Artifacts
- Developer: Apache Software Foundation
- Deployer: Apache Software Foundation
- Artifact Details:
| Type | Name |
|---|---|
| System | Apache Parquet |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CWE
| ID | Description |
|---|---|
| CWE-20 | CWE-20 Improper Input Validation |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2021-12-20
- Version: 0.3.3
- AVID Entry