apache-arrow vulnerabilities (Debian)

2 vulnerabilities.

• apache-arrow Debian Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation CVE-2026-92287 8.1 HighOctober 20, 2026
• apache-arrow Debian Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering CVE-2026-25087 Fix available 7.0 HighFebruary 17, 2026