Apache Software Foundation Arrow vulnerabilities

• apache software foundation arrow rust Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads CVE-2026-111959 Fix available 9.1 CriticalNovember 2, 2026
• apache software foundation arrow c++, pyarrow +1 more Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation CVE-2026-92287 8.1 HighOctober 20, 2026
• apache arrow Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering CVE-2026-25087 Fix available 7.0 HighFebruary 17, 2026
• apache arrow, apache software foundation arrow r package +1 more Apache Arrow R package: Arbitrary code execution when loading a malicious data file CVE-2024-52338 Fix available 9.8 CriticalNovember 28, 2024
• apache arrow, apache software foundation arrow rust object store +1 more Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files CVE-2024-41178 Fix available 7.5 HighJuly 23, 2024
• apache arrow Missing Initialization of Resource in Apache Arrow CVE-2019-12408 Fix available 7.5 HighNovember 8, 2019
• apache arrow Missing Initialization of Resource in Apache Arrow CVE-2019-12410 Fix available 7.5 HighNovember 8, 2019