CVE-2021-41561: Apache Parquet Java DOS Vulnerability

CVE-2021-41561 Overview

CVE-2021-41561 is an Improper Input Validation vulnerability in Parquet-MR of Apache Parquet that allows an attacker to cause a Denial of Service (DoS) condition through specially crafted malicious Parquet files. Apache Parquet is a widely-used columnar storage format designed for efficient data storage and retrieval, commonly deployed in big data ecosystems including Apache Spark, Apache Hive, and Apache Impala.

Critical Impact

Attackers can exploit this vulnerability to crash applications processing Parquet files, disrupting data pipelines and analytics workloads that rely on Apache Parquet-MR for file parsing operations.

Affected Products

• Apache Parquet Java (Parquet-MR) version 1.9.0 and later versions

Discovery Timeline

• 2021-12-20 - CVE-2021-41561 published to NVD
• 2025-07-28 - Last updated in NVD database

Technical Details for CVE-2021-41561

Vulnerability Analysis

This vulnerability stems from insufficient input validation within the Parquet-MR library when processing Parquet file structures. The lack of proper validation allows maliciously crafted Parquet files to trigger resource exhaustion or application crashes when parsed by vulnerable versions of the library. Since Parquet-MR is the core Java implementation for reading and writing Parquet files, this vulnerability has broad implications for Java-based big data applications.

The vulnerability is classified under CWE-20 (Improper Input Validation), indicating that the root cause lies in the failure to properly validate or sanitize input data before processing. In this case, the library does not adequately verify the integrity and format of incoming Parquet file structures before attempting to parse them.

Root Cause

The vulnerability exists due to improper input validation in Parquet-MR's file parsing logic. When processing Parquet files, the library fails to adequately validate certain file structures or metadata fields, allowing attackers to craft files that exploit this weakness. The lack of boundary checks or format validation enables malicious input to trigger unexpected behavior in the parsing routines.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious Parquet file and delivering it to a system running vulnerable versions of Apache Parquet-MR. The attack is network-exploitable, requiring no privileges or user interaction to execute. Attack scenarios include:

• Uploading malicious Parquet files to data lakes or storage systems processed by vulnerable applications
• Injecting malformed Parquet data into ETL pipelines
• Submitting crafted files to analytics platforms that automatically process incoming Parquet data

The vulnerability manifests during file parsing operations when the Parquet-MR library processes the malicious file structure. For technical details on the specific parsing behavior, refer to the Apache Mailing List Thread and the Openwall OSS Security Update.

Detection Methods for CVE-2021-41561

Indicators of Compromise

• Unexpected application crashes or service interruptions when processing Parquet files
• Abnormal resource consumption (CPU, memory) during Parquet file parsing operations
• Error logs indicating parsing failures or malformed file exceptions in Parquet-MR components
• Unusual Parquet files with irregular metadata or structure anomalies appearing in data pipelines

Detection Strategies

• Implement file validation checks before processing Parquet files in production environments
• Monitor application logs for Parquet-MR parsing exceptions or stack traces indicating input validation failures
• Deploy runtime application self-protection (RASP) solutions to detect anomalous parsing behavior
• Use SentinelOne Singularity to monitor for process crashes and resource exhaustion patterns associated with DoS attacks

Monitoring Recommendations

• Enable verbose logging for Parquet-MR library operations to capture detailed parsing information
• Set up alerts for sudden spikes in resource utilization by applications processing Parquet files
• Monitor data ingestion pipelines for files that trigger repeated parsing failures
• Implement health checks for services dependent on Parquet file processing

How to Mitigate CVE-2021-41561

Immediate Actions Required

• Identify all applications and services using Apache Parquet-MR version 1.9.0 or later
• Prioritize patching systems that process Parquet files from untrusted or external sources
• Implement input validation and file integrity checks as an additional defense layer
• Consider temporarily restricting Parquet file uploads from untrusted sources until patches are applied

Patch Information

Apache has addressed this vulnerability in updated versions of Parquet-MR. Organizations should upgrade to the latest patched version of Apache Parquet Java to remediate this issue. For detailed patch information and version guidance, consult the Apache Mailing List Thread.

Workarounds

• Implement file validation middleware to inspect Parquet files before processing
• Deploy network segmentation to isolate systems processing untrusted Parquet files
• Use application-level resource limits to prevent DoS conditions from affecting entire systems
• Consider sandboxing Parquet parsing operations in isolated environments

# Example: Configure resource limits for Java applications processing Parquet files
# Add to JVM startup options to limit memory and prevent complete system exhaustion
java -Xmx2g -Xms512m -XX:+HeapDumpOnOutOfMemoryError \
  -XX:HeapDumpPath=/var/log/parquet-crashes/ \
  -jar your-parquet-application.jar