42.PARQUET – A ZIP BOMB FOR THE BIG DATA AGE

Summary from the TLDR newsletter

Apache Parquet, the de facto standard for tabular data exchange, uses a binary, columnar, and compressed data representation and comes with enough metadata so that files can be correctly interpreted without additional information. The format is supported by most modern data tools and services. Parquet files come with some risks - even perfectly valid files can be problematic. This article discusses how to exploit one of the vulnerabilities in the Parquet file format to create a 'zip bomb' that is only 42 kilobytes large but contains 622 trillion values, requiring over 4 petabytes of memory to decompress.