Thanks for reporting this Yiming, GitHub is having some issues, but I'll take a look later today. We might want to follow up with a 1.18.1 patch release to fix this issue.
Kind regards, Fokko Driesprong On 2026/08/14 17:31:26 Yiming Li via dev wrote: > Hi Parquet Dev Team, > > I’d like to request a review for PR #3717 > <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716 > <https://github.com/apache/parquet-java/issues/3716>). > > *Why this is urgent for 1.18.x:* > > - > > *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively > upgrading to 1.18.0 to address critical *Jackson CVEs*. > - > > *Adoption Blocker:* However, 1.18.0 introduced a silent data corruption > bug in ByteBufferBackedBinary.getBytes() when reading repeated/array > columns. This makes upgrading to 1.18.0 unsafe for production. > > *Summary of Fix:* PR #3717 > <https://github.com/apache/parquet-java/pull/3717> updates getBytes() and > toStringUsingUTF8() to .duplicate() the buffer before adjusting > limits/positions so shared page-wide buffers aren't clobbered during lazy > record assembly. Regression tests covering this pattern have been added. > > Getting this fix reviewed and merged so it can be included in a 1.18.1 > patch release would allow ouor product to upgrade safely and resolve the > Jackson CVEs. > > Thanks, > > Yiming Li > > VMware Tanzu Greenplum, Broadcom >
