Note that the vulnerability applies to the Java library (or systems that use it, like Spark),as mentioned in the original source.

Amazing how not mentioning such important detail is even possible.

Saying the vulnerability is in Parquet itself gets more clicks.