CVE-2026-111959

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

CVE-2026-111959

The Apache Arrow Rust (arrow crate) contains an out-of-bounds read vulnerability affecting versions 33.0.0 through 57.3.1 , 58.4.0 , 59.3.1 , and 60.0.0 . The root cause is improper validation of RunEndEncoded arrays within the ArrayData interface, which can lead to reading data beyond the bounds...

CVE-2026-111959 Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

EUVD-2026-115182

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

CVE-2026-111959: Apache Software Foundation Apache Arrow Rust: Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1,…

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

PT-2026-135435

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

apache-arrow-26.0.0-1.1 on GA media (moderate)

apache-arrow-26.0.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:12191-1 Rating: moderate Cross-References: CVE-2024-41178 CVE-2026-25087 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issues fixed in t...

CVE-2026-114501

A flaw was found in Pillow. This vulnerability can lead to information disclosure when exporting images to Apache Arrow format with memory alignment enabled, as the library assumes image rows are contiguous in memory. Consequently, exported buffers may incorporate uninitialized padding or residua...

External Control of System or Configuration Setting

Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the GetKmsClientFromConfigOrKeyMaterial function, which falls back to the KMS URL embedded in a Parquet file's key material when KmsConnectionConfig does not specify one, and forwar...

CVE-2026-92287

A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service KMS client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implementation. An attacker can supply a maliciously crafted Parqu...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

A vulnerability exists in Apache C++ Parquet and PyArrow (versions 4.0.0 to 25.0.1) where unvalidated KMS URLs embedded in Parquet files are passed to pluggable KmsClient implementations. If a user does not specify a KMS URL in the KmsConnectionConfig, the application falls back to the file-contr...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

OPENSUSE-SU-2026:12191-1 apache-arrow-26.0.0-1.1 on GA media

These are all security issues fixed in the apache-arrow-26.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

Apache Arrow C input validation error vulnerability

A vulnerability related to input validation exists in Apache Arrow versions C 4.0.0 through 26.0.0 and PyArrow versions 8.0.0 through 26.0.0. This vulnerability arises because an unvalidated KMS URL is passed to the KMS client. When no application control is applied to the KMS URL within...

cloudquery cli-v6.42.3

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-30922 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS attack caus...

cloudquery cli-v6.42.2

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

cloudquery plugins-destination-snowflake-v5.2.14

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...