CVE-2021-41561: Apache Parquet Java DOS Vulnerability

CVE-2021-41561 Overview

CVE-2021-41561 is an Improper Input Validation vulnerability in Parquet-MR of Apache Parquet that allows an attacker to cause a Denial of Service (DoS) condition through specially crafted malicious Parquet files. Apache Parquet is a widely-used columnar storage format designed for efficient data storage and retrieval, commonly deployed in big data ecosystems including Apache Spark, Apache Hive, and Apache Impala.

Critical Impact
Attackers can exploit this vulnerability to crash applications processing Parquet files, disrupting data pipelines and analytics workloads that rely on Apache Parquet-MR for file parsing operations.

Affected Products

Apache Parquet Java (Parquet-MR) version 1.9.0 and later versions

Discovery Timeline

2021-12-20 - CVE-2021-41561 published to NVD
2025-07-28 - Last updated in NVD database

Technical Details for CVE-2021-41561

Vulnerability Analysis

This vulnerability stems from insufficient input validation within the Parquet-MR library when processing Parquet file structures. The lack of proper validation allows maliciously crafted Parquet files to trigger resource exhaustion or application crashes when parsed by vulnerable versions of the library. Since Parquet-MR is the core Java implementation for reading and writing Parquet files, this vulnerability has broad implications for Java-based big data applications.

The vulnerability is classified under CWE-20 (Improper Input Validation), indicating that the root cause lies in the failure to properly validate or sanitize input data before processing. In this case, the library does not adequately verify the integrity and format of incoming Parquet file structures before attempting to parse them.

Root Cause

The vulnerability exists due to improper input validation in Parquet-MR's file parsing logic. When processing Parquet files, the library fails to adequately validate certain file structures or metadata fields, allowing attackers to craft files that exploit this weakness. The lack of boundary checks or format validation enables malicious input to trigger unexpected behavior in the parsing routines.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious Parquet file and delivering it to a system running vulnerable versions of Apache Parquet-MR. The attack is network-exploitable, requiring no privileges or user interaction to execute. Attack scenarios include:

Uploading malicious Parquet files to data lakes or storage systems processed by vulnerable applications
Injecting malformed Parquet data into ETL pipelines
Submitting crafted files to analytics platforms that automatically process incoming Parquet data

The vulnerability manifests during file parsing operations when the Parquet-MR library processes the malicious file structure. For technical details on the specific parsing behavior, refer to the Apache Mailing List Thread and the Openwall OSS Security Update.

Detection Methods for CVE-2021-41561

Indicators of Compromise

Unexpected application crashes or service interruptions when processing Parquet files
Abnormal resource consumption (CPU, memory) during Parquet file parsing operations
Error logs indicating parsing failures or malformed file exceptions in Parquet-MR components
Unusual Parquet files with irregular metadata or structure anomalies appearing in data pipelines

Detection Strategies

Implement file validation checks before processing Parquet files in production environments
Monitor application logs for Parquet-MR parsing exceptions or stack traces indicating input validation failures
Deploy runtime application self-protection (RASP) solutions to detect anomalous parsing behavior
Use SentinelOne Singularity to monitor for process crashes and resource exhaustion patterns associated with DoS attacks

Monitoring Recommendations

Enable verbose logging for Parquet-MR library operations to capture detailed parsing information
Set up alerts for sudden spikes in resource utilization by applications processing Parquet files
Monitor data ingestion pipelines for files that trigger repeated parsing failures
Implement health checks for services dependent on Parquet file processing

How to Mitigate CVE-2021-41561

Immediate Actions Required

Identify all applications and services using Apache Parquet-MR version 1.9.0 or later
Prioritize patching systems that process Parquet files from untrusted or external sources
Implement input validation and file integrity checks as an additional defense layer
Consider temporarily restricting Parquet file uploads from untrusted sources until patches are applied

Patch Information

Apache has addressed this vulnerability in updated versions of Parquet-MR. Organizations should upgrade to the latest patched version of Apache Parquet Java to remediate this issue. For detailed patch information and version guidance, consult the Apache Mailing List Thread.

Workarounds

Implement file validation middleware to inspect Parquet files before processing
Deploy network segmentation to isolate systems processing untrusted Parquet files
Use application-level resource limits to prevent DoS conditions from affecting entire systems
Consider sandboxing Parquet parsing operations in isolated environments

bash

# Example: Configure resource limits for Java applications processing Parquet files
# Add to JVM startup options to limit memory and prevent complete system exhaustion
java -Xmx2g -Xms512m -XX:+HeapDumpOnOutOfMemoryError \
  -XX:HeapDumpPath=/var/log/parquet-crashes/ \
  -jar your-parquet-application.jar