CVE-2026-73334

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73334", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-12T06:00:31.756Z", "datePublished": "2026-09-09T10:48:46.250Z", "dateUpdated": "2026-09-10T17:55:48.179Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-09T10:48:46.250Z"}, "title": "Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation", "problemTypes": [{"descriptions": [{"description": "CWE-20 Improper Input Validation", "lang": "en", "cweId": "CWE-20", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Parquet Hadoop", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.parquet.crypto.keytools:parquet-hadoop", "packageURL": "pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop", "versions": [{"status": "affected", "version": "1.12", "lessThanOrEqual": "1.18.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Potential problem for users of the&nbsp;org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. <br>This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).&nbsp;<br>On the reader side, the KMS URL can be application-controlled or file-controlled.<br><span>If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. <br>If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.<br><br></span>Before the problem is fixed, users are recommended to&nbsp;leverage application control for KMS URL parameter in readers (versions 1.12-1.18).<br>After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter&nbsp;<br>will have two options then:&nbsp;leverage application control for KMS URL parameter in readers, or enable file-controlled&nbsp;KMS URL (via a new app parameter).<br>The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."}]}], "references": [{"url": "https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "n0mi1k", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/08/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-09T11:10:59.669Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T17:54:53.098628Z", "id": "CVE-2026-73334", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T17:55:48.179Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/08/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-09T11:10:59.669Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-73334", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T17:54:53.098628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T17:55:43.941Z"}}], "cna": {"title": "Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "n0mi1k"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Parquet Hadoop", "versions": [{"status": "affected", "version": "1.12", "versionType": "custom", "lessThanOrEqual": "1.18.0"}], "packageURL": "pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop", "packageName": "org.apache.parquet.crypto.keytools:parquet-hadoop", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.", "supportingMedia": [{"type": "text/html", "value": "Potential problem for users of the&nbsp;org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. <br>This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).&nbsp;<br>On the reader side, the KMS URL can be application-controlled or file-controlled.<br><span>If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. <br>If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.<br><br></span>Before the problem is fixed, users are recommended to&nbsp;leverage application control for KMS URL parameter in readers (versions 1.12-1.18).<br>After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter&nbsp;<br>will have two options then:&nbsp;leverage application control for KMS URL parameter in readers, or enable file-controlled&nbsp;KMS URL (via a new app parameter).<br>The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-09T10:48:46.250Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73334", "state": "PUBLISHED", "dateUpdated": "2026-09-10T17:55:48.179Z", "dateReserved": "2026-08-12T06:00:31.756Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-09T10:48:46.250Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.parquet.crypto.keytools:parquet-hadoop", "packageURL": "pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop", "product": "Apache Parquet Hadoop", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.18.0", "status": "affected", "version": "1.12", "versionType": "custom"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:parquet:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB667A85-3B59-4E7A-A75F-F5D41F50630B", "versionEndIncluding": "1.18.0", "versionStartIncluding": "1.12.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0\nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."}], "id": "CVE-2026-73334", "lastModified": "2026-09-10T20:36:22.303", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73334", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T17:54:53.098628Z", "version": "2.0.3"}}]}, "published": "2026-09-09T11:17:15.220", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/09/08/11"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.parquet/parquet-hadoop: Apache Parquet Hadoop: KMS token disclosure due to missing host validation", "id": "2530719", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530719"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Apache Parquet Hadoop. When processing a Parquet file, if the Key Management Service (KMS) Uniform Resource Locator (URL) is controlled by the file and not explicitly set by the application, a vulnerability can arise. An attacker could craft a malicious Parquet file to direct a KMS token to an arbitrary malicious server if the client implementation does not validate the host. This could lead to the unauthorized disclosure of sensitive KMS tokens."], "mitigation": {"lang": "en:us", "value": "Upgrade Apache Parquet Java to version 1.18.1 or later, which disables file-controlled KMS URLs by default. Until upgraded, applications should use an application-controlled KMS URL when reading encrypted Parquet files. If application control is not possible, validate the file-controlled KMS URL and use authentication in the custom KMS client implementation."}, "name": "CVE-2026-73334", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "parquet-hadoop", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-09T10:48:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73334\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73334\nhttps://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0"], "statement": "Red Hat is aware of this vulnerability in Apache Parquet Java. The issue affects applications that use file-controlled KMS URLs when reading encrypted Parquet files with a custom KMS client that does not validate the destination host. Red Hat rates this vulnerability as Moderate.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.12,1.18.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "parquet_hadoop", "vendor": "apache"}], "created": "2026-09-09T12:30:09.952386+00:00", "updated": "2026-09-10T23:30:12.716355+00:00", "vendors": ["apache", "apache$PRODUCT$parquet_hadoop"]}