CVE-2026-42241

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42241", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T05:37:12.118Z", "datePublished": "2026-05-07T18:52:06.773Z", "dateUpdated": "2026-05-08T21:30:27.110Z"}, "containers": {"cna": {"title": "ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width", "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88"}, {"name": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1"}], "affected": [{"vendor": "G-Research", "product": "ParquetSharp", "versions": [{"version": ">= 18.1.0, < 23.0.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T18:52:06.773Z"}, "descriptions": [{"lang": "en", "value": "ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1."}], "source": {"advisory": "GHSA-rrjr-v56m-ww88", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T14:38:23.750570Z", "id": "CVE-2026-42241", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T21:30:27.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42241", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:38:23.750570Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T14:38:31.554Z"}}], "cna": {"title": "ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width", "source": {"advisory": "GHSA-rrjr-v56m-ww88", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "G-Research", "product": "ParquetSharp", "versions": [{"status": "affected", "version": ">= 18.1.0, < 23.0.0.1"}]}], "references": [{"url": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88", "name": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1", "name": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T18:52:06.773Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42241", "state": "PUBLISHED", "dateUpdated": "2026-05-08T21:30:27.110Z", "dateReserved": "2026-04-25T05:37:12.118Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T18:52:06.773Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ParquetSharp", "vendor": "G-Research", "versions": [{"status": "affected", "version": ">= 18.1.0, < 23.0.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1."}, {"lang": "es", "value": "ParquetSharp es una biblioteca .NET para leer y escribir archivos Apache Parquet. Desde la versi\u00f3n 18.1.0 hasta antes de la versi\u00f3n 23.0.0.1, DecimalConverter.ReadDecimal realiza un stackalloc utilizando lo que podr\u00eda ser un valor proporcionado por un atacante. Si un atacante declara una columna decimal con un ancho irrazonable, esto podr\u00eda llevar a un desbordamiento de pila. En un entorno de servicio, esto podr\u00eda potencialmente derribar un servicio. Esto afecta a las aplicaciones que utilizan ParquetSharp para leer archivos Parquet no confiables en un servicio de red. Este problema ha sido parcheado en la versi\u00f3n 23.0.0.1."}], "id": "CVE-2026-42241", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42241", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T14:38:23.750570Z", "version": "2.0.3"}}]}, "published": "2026-05-07T20:16:44.247", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.1.0,23.0.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ParquetSharp", "source": "cna", "vendor": "G-Research"}, "product": "parquetsharp", "vendor": "g-research"}], "created": "2026-05-07T20:45:22.133997+00:00", "updated": "2026-05-07T21:24:24.028877+00:00", "vendors": ["g-research", "g-research$PRODUCT$parquetsharp"]}