ParquetSharp Stack Overflow Vulnerability in Decimal Column Handling

A stack overflow vulnerability has been identified in ParquetSharp, a .NET library for processing Apache Parquet files. This issue affects versions 18.1.0 prior to 23.0.0.1. The vulnerability arises in the DecimalConverter.ReadDecimal method, which uses stack allocation based on potentially attacker-supplied values. If a decimal column with an excessive width is declared, it could lead to a stack overflow. In a service environment, this could disrupt the service. The vulnerability impacts applications that use ParquetSharp to read untrusted Parquet files over the network.

Impact

Exploitation of this vulnerability can cause a stack overflow, potentially leading to a denial of service by crashing the application or service that is processing the Parquet file.

Remediation

Users are advised to upgrade to ParquetSharp version 23.0.0.1 or later. The updated version is available on NuGet.