5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rrjr-v56m-ww88

GHSA-rrjr-v56m-ww88: ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.

This affects applications using ParquetSharp to read untrusted Parquet files in a network service.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rrjr-v56m-ww88

GHSA-rrjr-v56m-ww88:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ParquetSharp	nuget	>= 18.1.0, < 23.0.0.1	23.0.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the ParquetSharp library, where the DecimalConverter.ReadDecimal function uses stackalloc to allocate memory on the stack. The size of this allocation is based on the Length of a ByteArray object, which is derived from the metadata of a Parquet file. An attacker can craft a malicious Parquet file with a decimal column that specifies an excessively large width. When ParquetSharp attempts to read this file, it calls ReadDecimal, which in turn attempts a huge stack allocation. This allocation exceeds the available stack space, causing a stack overflow and leading to a denial of service by crashing the process. The patch, identified in commit 6824d297f9c7a798222fa6cfc693f0f954a2b08f, mitigates this by checking the requested allocation size. If the size exceeds a predefined threshold (MaxStackAllocSize), the allocation is performed on the heap using ArrayPool<byte>.Shared.Rent() instead of the stack, thus preventing the overflow. The same vulnerability pattern and fix were also applied to the DecimalConverter.WriteDecimal function.

Vulnerable functions

ParquetSharp.DecimalConverter.ReadDecimal

csharp/DecimalConverter.cs

The function `ReadDecimal` allocates a buffer on the stack using `stackalloc`. The size of this buffer is determined by `byteArray.Length`, which is derived from the metadata of the Parquet file being read. An attacker can craft a file with a decimal column having an extremely large type width, causing `byteArray.Length` to be a large value. This leads to a large stack allocation, which can cause a stack overflow and crash the application.

ParquetSharp.DecimalConverter.WriteDecimal

csharp/DecimalConverter.cs

Although the advisory focuses on `ReadDecimal`, the `WriteDecimal` function contained the same vulnerable pattern of using `stackalloc` with a potentially large, user-controllable size (`byteArray.Length`). The fix was applied to this function as well, indicating it was also susceptible to a stack overflow if a very large decimal value was being written.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.