GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-73334 (GCVE-0-2026-73334)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:48 – Updated: 2026-09-09 11:10
VLAI
Title
Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Summary
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).  On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter  will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.
Severity
No CVSS data available.
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Parquet Hadoop Affected: 1.12 , ≤ 1.18.0 (custom)
guessed Create a notification for this product.
Credits
n0mi1k
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:59.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.parquet.crypto.keytools:parquet-hadoop",
          "packageURL": "pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop",
          "product": "Apache Parquet Hadoop",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.18.0",
              "status": "affected",
              "version": "1.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "n0mi1k"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Potential problem for users of the\u0026nbsp;org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \u003cbr\u003eThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u0026nbsp;\u003cbr\u003eOn the reader side, the KMS URL can be application-controlled or file-controlled.\u003cbr\u003e\u003cspan\u003eIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \u003cbr\u003eIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003eBefore the problem is fixed, users are recommended to\u0026nbsp;leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\u003cbr\u003eAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u0026nbsp;\u003cbr\u003ewill have two options then:\u0026nbsp;leverage application control for KMS URL parameter in readers, or enable file-controlled\u0026nbsp;KMS URL (via a new app parameter).\u003cbr\u003eThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."
            }
          ],
          "value": "Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:48:46.250Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-73334",
    "datePublished": "2026-09-09T10:48:46.250Z",
    "dateReserved": "2026-08-12T06:00:31.756Z",
    "dateUpdated": "2026-09-09T11:10:59.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73334",
      "date": "2026-09-10",
      "epss": "0.00159",
      "percentile": "0.05371"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73334\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-09-09T11:17:15.220\",\"lastModified\":\"2026-09-09T15:37:09.320\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \\nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \\nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\\n\\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Parquet Hadoop\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"org.apache.parquet.crypto.keytools:parquet-hadoop\",\"packageURL\":\"pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop\",\"versions\":[{\"version\":\"1.12\",\"lessThanOrEqual\":\"1.18.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/09/08/11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-09T12:48:31+00:00",
      "cve": "CVE-2026-73334",
      "id": "CVE-2026-73334",
      "initial_release_date": "2026-09-09T10:48:46.250000+00:00",
      "product_status:known_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "org.apache.parquet/parquet-hadoop: Apache Parquet Hadoop: KMS token disclosure due to missing host validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73334.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.