{"api_version":"1","generated_at":"2026-09-11T00:21:22+00:00","cve":"CVE-2026-73334","urls":{"html":"https://cve.report/CVE-2026-73334","api":"https://cve.report/api/cve/CVE-2026-73334.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-73334","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-73334"},"summary":{"title":"Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation","description":"Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). \nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter \nwill have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.","state":"PUBLISHED","assigner":"apache","published_at":"2026-09-09 11:17:15","updated_at":"2026-09-10 20:36:22"},"problem_types":["CWE-20","CWE-20 CWE-20 Improper Input Validation"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/08/11","name":"http://www.openwall.com/lists/oss-security/2026/09/08/11","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0","name":"https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0","refsource":"security@apache.org","tags":["Mailing List","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73334","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73334","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Parquet Hadoop","version":"affected 1.12 1.18.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"n0mi1k","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"73334","vulnerable":"1","versionEndIncluding":"1.18.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"parquet","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"73334","cve":"CVE-2026-73334","epss":"0.001590000","percentile":"0.053710000","score_date":"2026-09-10","updated_at":"2026-09-11 00:05:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-09-09T11:10:59.669Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/08/11"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-73334","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-10T17:54:53.098628Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-10T17:55:48.179Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.parquet.crypto.keytools:parquet-hadoop","packageURL":"pkg:maven/org.apache.parquet.crypto.keytools/parquet-hadoop","product":"Apache Parquet Hadoop","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.18.0","status":"affected","version":"1.12","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"n0mi1k"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Potential problem for users of the&nbsp;org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. <br>This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).&nbsp;<br>On the reader side, the KMS URL can be application-controlled or file-controlled.<br><span>If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. <br>If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.<br><br></span>Before the problem is fixed, users are recommended to&nbsp;leverage application control for KMS URL parameter in readers (versions 1.12-1.18).<br>After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter&nbsp;<br>will have two options then:&nbsp;leverage application control for KMS URL parameter in readers, or enable file-controlled&nbsp;KMS URL (via a new app parameter).<br>The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."}],"value":"Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). \nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter \nwill have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-09T10:48:46.250Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/ro2vomk9xxhv34xhvopgys96c9j8ojm0"}],"source":{"discovery":"UNKNOWN"},"title":"Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-73334","datePublished":"2026-09-09T10:48:46.250Z","dateReserved":"2026-08-12T06:00:31.756Z","dateUpdated":"2026-09-10T17:55:48.179Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-09 11:17:15","lastModifiedDate":"2026-09-10 20:36:22","problem_types":["CWE-20","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T17:54:53.098628Z","id":"CVE-2026-73334","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:parquet:*:*:*:*:*:*:*:*","versionStartIncluding":"1.12.2","versionEndIncluding":"1.18.0","matchCriteriaId":"FB667A85-3B59-4E7A-A75F-F5D41F50630B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"73334","Ordinal":"1","Title":"Apache Parquet Hadoop: File-controlled KMS URL is forwarded to p","CVE":"CVE-2026-73334","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"73334","Ordinal":"1","NoteData":"Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. \nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). \nOn the reader side, the KMS URL can be application-controlled or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. \nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.\n\nBefore the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18).\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter \nwill have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter).\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.","Type":"Description","Title":"Apache Parquet Hadoop: File-controlled KMS URL is forwarded to p"}]}}}