parquet-java

Unless you're logging user input without proper validation, log4j doesn't really seem that bad. As a library, this is a huge problem. If you're a user of the library, you'll have to decide if your usage of it is problematic or not. Either way, the safe solution is to just update the library. Or, based on the link shared elsewhere (https://github.com/apache/parquet-java/compare/apache-parque...) maybe avoid this library if you can, because the Java-specific code paths seem sketchy as hell to me.

Better link: https://github.com/apache/parquet-java/pull/3169 If by “classic” you mean “using a language-dependent deserialization mechanism that is wildly unsafe”, I suppose. The surprising part is that Parquet is a fairly modern format with a real schema that is nominally language-independent. How on Earth did Java class names end up in the file format? Why is the parser willing to parse them at all? At most (at least by default), the parser should treat them as predefined strings that have semantics completely independent of any actual Java class.

When did vulnerability reports get so vague? Looks like a classic serialization bug https://github.com/apache/parquet-java/compare/apache-parque...