Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-73334

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18

CVE-2026-73334: Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Apache publishes the next one.

VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

CVE-2026-73334 key facts

CISA KEV: Not listed (catalog checked Oct 28, 2026)
Highest advisory severity: High
CVSS base score: 8.1 (Apache), 6.5 (Red Hat)
Vendor advisories: 2 from Apache, Red Hat
VulniPulse record: Published Sep 9, 2026 · Updated Sep 16, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-73334; bulletin-wide values are not repeated here.

Is CVE-2026-73334 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-73334 is not in the CISA KEV catalog (checked Oct 28, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-73334?

Users of the KMS URL parameter will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). (Apache)
Upgrade Apache Parquet Java to version 1.18.1 or later, which disables file-controlled KMS URLs by default. Until upgraded, applications should use an application-controlled KMS URL when reading encrypted Parquet files. If application control is not possible, validate the file-controlled KMS URL and use authentication in the custom KMS client implementation. (Red Hat)

Vendor advisory comparison

Apache

1 advisory

Advisory severityHigh8.1
High [CVE-2026-73334] Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18
CVE-2026-73334Source published Sep 9, 2026Source updated Sep 10, 2026
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the…
Affected products in this advisory
Apache Parquet
Source-reported affected versions
1.12-1
Source-reported fixed versions
No fixed-version detail extracted. This does not mean no fix exists.
Mitigation guidance
Users of the KMS URL parameter will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter).
Workarounds
After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default.
Full advisory and evidence Open source bulletin

Red Hat

1 advisory

Advisory severityMedium6.5
Medium [CVE-2026-73334] KMS token disclosure due to missing host validation
CVE-2026-73334Source published Sep 9, 2026Source updated Sep 9, 2026
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On the reader side, the KMS URL can be application-controlled or file-controlled. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. The latter option will explicitly require…
Affected products in this advisory
Red Hat Fuse 7
Red Hat OpenShift AI (RHOAI)
Source-reported affected versions
< 1.12-1
Source-reported fixed versions
No fixed-version detail extracted. This does not mean no fix exists.
Mitigation guidance
Upgrade Apache Parquet Java to version 1.18.1 or later, which disables file-controlled KMS URLs by default. Until upgraded, applications should use an application-controlled KMS URL when reading encrypted Parquet files. If application control is not possible, validate the file-controlled KMS URL and use authentication in the custom KMS client implementation.
Full advisory and evidence Open source bulletin

All Apache advisories

Follow CVE-2026-73334 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features