{"id":"GHSA-rrjr-v56m-ww88","revision":"807ded5f07a24e4c850acb792fc173af","records":[{"revision":"807ded5f07a24e4c850acb792fc173af","observedAt":"2026-10-23T16:01:25.029+00:00","statement":{"source":"osv","id":"GHSA-rrjr-v56m-ww88","aliases":["CVE-2026-42241"],"title":"ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width","description":"`DecimalConverter.ReadDecimal` makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.\n\nThis affects applications using ParquetSharp to read untrusted Parquet files in a network service.","state":0,"publishedAt":"2026-04-24T16:39:55+00:00","modifiedAt":"2026-05-11T13:53:07.100127+00:00","affected":[{"ecosystem":"NuGet","name":"ParquetSharp","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"18.1.0"},{"kind":"fixed","version":"23.0.0.1"}]}],"versions":["18.1.0","19.0.1","19.0.1-beta1","20.0.0","20.0.0-beta1","20.0.0-beta2","21.0.0","21.0.0-beta1","23.0.0","23.0.0-beta1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88","https://nvd.nist.gov/vuln/detail/CVE-2026-42241","https://github.com/G-Research/ParquetSharp","https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1"],"sourceUrl":"https://github.com/advisories/GHSA-rrjr-v56m-ww88","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rrjr-v56m-ww88","identifiers":["GHSA-rrjr-v56m-ww88","CVE-2026-42241"]},"retained":false,"historicalAffected":[]}],"coverage":[]}