Thanks Fokko, that will be very helpful with the 1.81.1 patch release! On Mon, Aug 17, 2026 at 7:39 AM Fokko Driesprong <[email protected]> wrote:
> Thanks for reporting this Yiming, > > GitHub is having some issues, but I'll take a look later today. We might > want to follow up with a 1.18.1 patch release to fix this issue. > > Kind regards, > Fokko Driesprong > > On 2026/08/14 17:31:26 Yiming Li via dev wrote: > > Hi Parquet Dev Team, > > > > I’d like to request a review for PR #3717 > > <https://github.com/apache/parquet-java/pull/3717> (fixes GH-3716 > > <https://github.com/apache/parquet-java/issues/3716>). > > > > *Why this is urgent for 1.18.x:* > > > > - > > > > *Security Upgrade Need:* Our team (VMware Tanzu Greenplum) is actively > > upgrading to 1.18.0 to address critical *Jackson CVEs*. > > - > > > > *Adoption Blocker:* However, 1.18.0 introduced a silent data > corruption > > bug in ByteBufferBackedBinary.getBytes() when reading repeated/array > > columns. This makes upgrading to 1.18.0 unsafe for production. > > > > *Summary of Fix:* PR #3717 > > <https://github.com/apache/parquet-java/pull/3717> updates getBytes() > and > > toStringUsingUTF8() to .duplicate() the buffer before adjusting > > limits/positions so shared page-wide buffers aren't clobbered during lazy > > record assembly. Regression tests covering this pattern have been added. > > > > Getting this fix reviewed and merged so it can be included in a 1.18.1 > > patch release would allow ouor product to upgrade safely and resolve the > > Jackson CVEs. > > > > Thanks, > > > > Yiming Li > > > > VMware Tanzu Greenplum, Broadcom > > >
smime.p7s
Description: S/MIME Cryptographic Signature
