Is azure synapse analytics apache spark pool affected by CVE-2025-30065?

Question

Is azure synapse analytics apache spark pool affected by CVE-2025-30065?

Virantha Tilakawardane 0

We have several instances of Synapse Analytics using v3.4 of Apache Spark Pool.

According to this page on Synapse there appear to be components of parquet that are v1.12.3 which is affected by the CVE https://nvd.nist.gov/vuln/detail/CVE-2025-30065

https://github.com/microsoft/synapse-spark-runtime/blob/main/Synapse/spark3.4/Candidate-Spark3.4-Rel-2025-03-26.1-rc.1.md

Would you be able to provide some clarity if the currently released runtime is affected?

If it is, is there a patch coming and when is it likely to be deployed?

J N S S Kasyap 3,625 Reputation points Microsoft External Staff Moderator

2025-04-10T19:39:28.64+00:00

Hi @Virantha Tilakawardane

Azure Synapse Analytics Apache Spark Pool using v3.4 of Apache Spark Pool includes components of Parquet that are v1.12.3, which is affected by CVE-2025-30065 This means that your instances of Synapse Analytics could potentially be vulnerable if they process Parquet files from untrusted sources.

It is advisable to monitor official channels for updates on patch availability. For latest Azure Synapse runtime releases Please check the below Microsoft Documentation
https://learn.microsoft.com/en-us/azure/synapse-analytics/spark/apache-spark-version-support

Guidance for handling CVE-2025-30065 using Microsoft Security capabilities:
https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/guidance-for-handling-cve-2025-30065-using-microsoft-security-capabilities/4401362

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Virantha Tilakawardane 0 Reputation points

2025-04-10T20:38:46.47+00:00

Hi @J N S S Kasyap - just clarifying, has Microsoft published an official acknowledgement of this vulnerability against the (currently available) Azure Synapse Analytics Apache Spark Pools?

It would be good to get some confirmation and a timeline of when a fix will be deployed.
J N S S Kasyap 3,625 Reputation points Microsoft External Staff Moderator

2025-04-10T20:45:54.2033333+00:00

@Virantha Tilakawardane

As of now, Microsoft has not published an official acknowledgment regarding the impact of CVE-2025-30065 on Azure Synapse Analytics Apache Spark Pools.
Given that Microsoft has not officially acknowledged this vulnerability in the context of Azure Synapse Analytics, there is currently no publicly available timeline for a fix. To stay informed about potential patches or mitigations, consider regularly checking Microsoft's official channels and support pages.
https://learn.microsoft.com/en-us/azure/synapse-analytics/spark/apache-spark-version-support

I hope this information helps. Please do let us know if you have any further queries.
J N S S Kasyap 3,625 Reputation points Microsoft External Staff Moderator

2025-04-11T18:52:00.79+00:00

@Virantha Tilakawardane
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Virantha Tilakawardane 0 Reputation points

2025-04-14T01:56:15.69+00:00

Hi @J N S S Kasyap - thanks for checking and for advice provided. As per your advice, we will do regular checks on MS channels for further updates from Microsoft. We will also look to action guidance by Microsoft (linked above).

Without an updated release from Microsoft, this issue will remain unresolved, and all users of the platform would need to be vigilant in the use of parquet files. Otherwise, we have not had any further news on this matter from Microsoft.

Thanks.

1 answer

Your answer

J N S S Kasyap 3,625 Reputation points Microsoft External Staff Moderator

2025-04-10T19:39:28.64+00:00

Hi @Virantha Tilakawardane

Azure Synapse Analytics Apache Spark Pool using v3.4 of Apache Spark Pool includes components of Parquet that are v1.12.3, which is affected by CVE-2025-30065 This means that your instances of Synapse Analytics could potentially be vulnerable if they process Parquet files from untrusted sources.

It is advisable to monitor official channels for updates on patch availability. For latest Azure Synapse runtime releases Please check the below Microsoft Documentation
https://learn.microsoft.com/en-us/azure/synapse-analytics/spark/apache-spark-version-support

Guidance for handling CVE-2025-30065 using Microsoft Security capabilities:
https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/guidance-for-handling-cve-2025-30065-using-microsoft-security-capabilities/4401362

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Virantha Tilakawardane 0 Reputation points

2025-04-10T20:38:46.47+00:00

Hi @J N S S Kasyap - just clarifying, has Microsoft published an official acknowledgement of this vulnerability against the (currently available) Azure Synapse Analytics Apache Spark Pools?

It would be good to get some confirmation and a timeline of when a fix will be deployed.
J N S S Kasyap 3,625 Reputation points Microsoft External Staff Moderator

2025-04-10T20:45:54.2033333+00:00

@Virantha Tilakawardane

As of now, Microsoft has not published an official acknowledgment regarding the impact of CVE-2025-30065 on Azure Synapse Analytics Apache Spark Pools.
Given that Microsoft has not officially acknowledged this vulnerability in the context of Azure Synapse Analytics, there is currently no publicly available timeline for a fix. To stay informed about potential patches or mitigations, consider regularly checking Microsoft's official channels and support pages.
https://learn.microsoft.com/en-us/azure/synapse-analytics/spark/apache-spark-version-support

I hope this information helps. Please do let us know if you have any further queries.
J N S S Kasyap 3,625 Reputation points Microsoft External Staff Moderator

2025-04-11T18:52:00.79+00:00

@Virantha Tilakawardane
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Virantha Tilakawardane 0 Reputation points

2025-04-14T01:56:15.69+00:00

Hi @J N S S Kasyap - thanks for checking and for advice provided. As per your advice, we will do regular checks on MS channels for further updates from Microsoft. We will also look to action guidance by Microsoft (linked above).

Without an updated release from Microsoft, this issue will remain unresolved, and all users of the platform would need to be vigilant in the use of parquet files. Otherwise, we have not had any further news on this matter from Microsoft.

Thanks.

Answer 1

J N S S Kasyap 3,625 Microsoft External Staff Moderator

@Virantha Tilakawardane
Appreciate if you could share the feedback on our Provide product feedback Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

Virantha Tilakawardane 0 Reputation points

2025-04-15T01:42:22.9566667+00:00

Thanks for the suggestion @J N S S Kasyap - I have submitted product feedback here: https://feedback.azure.com/d365community/idea/d9a971cb-8519-f011-9d47-7c1e526fee30

Share via

Is azure synapse analytics apache spark pool affected by CVE-2025-30065?

1 answer

Your answer