Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-42241ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
Medium 5.3
In plain English
A medium-severity security flaw in ParquetSharp from G-Research. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | parquetsharp | 23.0.0.1 | GHSA-rrjr-v56m-ww88 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| G-Research | ParquetSharp | >= 18.1.0, < 23.0.0.1 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88 x_refsource_CONFIRM
- https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1 x_refsource_MISC