Upgrade parquet-hadoop dependency from aircompressor 2.0.2 due to CVE-2025-67721

[rajesh-chandrashekar]

Describe the bug, including details regarding any error messages, version, and platform.

Vulnerability in io.airlift:aircompressor Dependency Used by parquet-hadoop

Summary

A published vulnerability (CVE-2025-67721) affects all versions of io.airlift:aircompressor except version 3.4.

CVE Reference:
https://www.cve.org/CVERecord?id=CVE-2025-67721

Currently, parquet-hadoop:1.15.2 depends on:

io.airlift:aircompressor:2.0.2

which is the latest release available under the original aircompressor artifact:

https://mvnrepository.com/artifact/io.airlift/aircompressor

However, newer releases have moved to a new artifact:

io.airlift:aircompressor-v3

Repository:
https://mvnrepository.com/artifact/io.airlift/aircompressor-v3

Request

Please update parquet-hadoop to use the newer aircompressor-v3 dependency so downstream consumers can remediate CVE-2025-67721.

Impact

Projects consuming parquet-hadoop inherit the vulnerable aircompressor dependency and are unable to mitigate the CVE without dependency overrides or exclusions.

Component(s)

No response

[yadavay-amzn]

I'd like to work on this. Will open a PR shortly with the migration to aircompressor-v3.

[ebyhr]

#3403 already updated it, right?

[yadavay-amzn]

@ebyhr Thanks for taking a look. PR #3403 bumped to 2.0.3. The CVE description says only version 3.4 of the new aircompressor-v3 artifact is unaffected, which would mean 2.0.3 is still vulnerable. But if 2.0.3 actually resolves it, then this issue can be closed. Do you know if 2.0.3 includes the fix?

[ebyhr]

@yadavay-amzn 2.0.3 has fixed CVE-2025-67721 as you can see:

• https://github.com/airlift/aircompressor/releases/tag/2.0.3
• Backport fixes for CVE-2025-67721 airlift/aircompressor#309

[yadavay-amzn]

Thanks for the links. This issue can be closed.

[Fokko]

Thanks for the context 👍