{"id":"EUVD-2026-28430","enisaUuid":"270dad2c-8e1d-3c44-b821-199b34981f52","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","datePublished":"May 7, 2026, 6:52:06 PM","dateUpdated":"May 8, 2026, 9:30:27 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88\nhttps://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1\n","aliases":"CVE-2026-42241\nGHSA-rrjr-v56m-ww88\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"52894b1f-99e0-3723-b1bb-93fcbf9fc280","product":{"name":"ParquetSharp","vendor":{"name":"G-Research"}},"product_version":"18.1.0, \u003c 23.0.0.1"}],"enisaIdVendor":[{"id":"f35d61e1-fa5e-3e68-a47b-2fc1eeed4d8a","vendor":{"name":"G-Research"}}],"enisaIdVulnerability":[{"id":"18f9eac5-5789-3b88-94cd-e1bc9d43c90e","vulnerability":{"id":"CVE-2026-42241","description":"ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1.","datePublished":"May 7, 2026, 6:52:06 PM","dateUpdated":"May 8, 2026, 9:30:27 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88\nhttps://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1\n","enisa_id":"EUVD-2026-28430\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 30, 2026, 7:17:17 AM","vulnerabilityProduct":[{"id":"6f654d01-c9d4-3f70-886f-d58f58fcdb74","product":{"name":"ParquetSharp","vendor":{"name":"G-Research"}},"product_version":"18.1.0, \u003c 23.0.0.1"}],"vulnerabilityVendor":[{"id":"4ca8008d-d699-3816-aff9-2f2af3e4991a","vendor":{"name":"G-Research"}}]}},{"id":"43f4a4ba-35c4-35a4-a527-d32507a96a79","vulnerability":{"id":"GHSA-rrjr-v56m-ww88","description":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","datePublished":"Apr 24, 2026, 4:39:55 PM","dateUpdated":"May 11, 2026, 1:29:39 PM","baseScore":0.0,"references":"https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42241\nhttps://github.com/G-Research/ParquetSharp\nhttps://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1\n","enisa_id":"EUVD-2026-28430\n","aliases":"CVE-2026-42241\nGHSA-rrjr-v56m-ww88\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}