CVE-2026-42241: ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

April 24, 2026 (updated May 11, 2026)

DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.

This affects applications using ParquetSharp to read untrusted Parquet files in a network service.

References

github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1
github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88
github.com/advisories/GHSA-rrjr-v56m-ww88
nvd.nist.gov/vuln/detail/CVE-2026-42241

Code Behaviors & Features

Detect and mitigate CVE-2026-42241 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →