Skip to content
OpenAdvisories

Package · Debian

apache-arrow

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.1
    CVE-2026-92287

    Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

    Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS …

    Apache Software Foundation PyArrow Apache Arrow C++ apache-arrow Debian Ubuntu
  • High 7.0
    CVE-2026-25087

    Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering

    Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadi…

    Apache Software Foundation Apache Arrow pyarrow apache-arrow Debian PyPI