PyArrow Flight RPC - Remote Code Execution

PyArrow Flight RPC from v0.14.0 through v14.0.0 allows remote attackers to execute arbitrary code via a maliciously crafted Python-defined extension type. id: CVE-2023-47248 info: name: PyArrow Flight RPC - Remote Code Execution author: smolse severity: critical description: | PyArrow Flight RPC...

Security Bulletin:Vulnerability in pyarrow affects IBM Netezza Appliance

Summary The pyarrow package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-25087 Vulnerability Details CVEID:CVE-2026-25087 DESCRIPTION: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through...

ROOT-APP-PYPI-CVE-2026-25087 CVE-2026-25087 in rootio-pyarrow - Patched by Root

Root has patched CVE-2026-25087 in the rootio-pyarrow package for Root:PyPI. Multiple fixed versions available...

arrow-pyarrow (>=55.2.0, <=59.0.0), ct-python (>=0.5.9, <=0.5.12) +3 more potentially affected by unknown CVE via pyo3 (>=0.24.2, <=0.28.3)

pyo3 CARGO version =0.24.2, =55.2.0, =0.5.9, =0.14.0, =0.14.0, =0.4.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0176...

ROOT-APP-PYPI-CVE-2023-47248 CVE-2023-47248 in rootio-pyarrow - Patched by Root

Root has patched CVE-2023-47248 in the rootio-pyarrow package for Root:PyPI. Multiple fixed versions available...

Deserialization Of Untrusted Data

Ray is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Ray Data globally registering custom Arrow extension types and passing metadata bytes directly to cloudpickle.loads during PyArrow schema parsing, which allows an attacker to achieve arbitrary code execution by...

PYSEC-2026-2272

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types ray.data.arrowtensor, ray.data.arrowtensorv2, ray.data.arrowvariableshapedtensor globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension type...

PYSEC-2026-2296

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types ray.data.arrowtensor, ray.data.arrowtensorv2, ray.data.arrowvariableshapedtensor globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension type...

PYSEC-2026-2272

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types ray.data.arrowtensor, ray.data.arrowtensorv2, ray.data.arrowvariableshapedtensor globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension type...

CVE-2026-41486

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types ray.data.arrowtensor, ray.data.arrowtensorv2, ray.data.arrowvariableshapedtensor globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension type...

Ray 代码注入漏洞

Ray is an open-source framework developed by ray-project, designed to extend AI and Python applications. Versions of Ray from 2.54.0 to 2.55.0 contained a code injection vulnerability. This vulnerability occurred when the PyArrow library read Parquet files by invoking arrowextdeserialize, allowin...

Ray 2.49.0 < 2.55.0 Remote Code Execution (CVE-2026-41486)

The version of Ray installed on the remote host is = 2.49.0 and prior to 2.55.0. It is, therefore, affected by a remote code execution vulnerability: - Ray Data registers custom Arrow extension types globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, i...

Security Bulletin: PyArrow vulnerability affecting IBM Watson Studio in Cloud Pak for Data (CVE-2023-47248)

Summary PyArrow vulnerability in Runtimes 22.2 and Runtimes 23.1 components impacting IBM Watson Studio in Cloud Pak for Data. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-47248 DESCRIPTION: Deserialization of untrusted data in IP...

VulnCheck KEV: CVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

CVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example user-supplied input files. This vulnerability only...

Security Bulletin: Vulnerability in PyArrow Affects IBM watsonx.data

Summary PyArrow could allow a remote authenticated attacker to execute arbitrary code on the system. This can affect IBM watsonx.data Vulnerability Details CVEID:CVE-2023-47248 DESCRIPTION: PyArrow could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an...

OPENSUSE-SU-2024:13431-1 python310-pyarrow-14.0.1-2.1 on GA media

These are all security issues fixed in the python310-pyarrow-14.0.1-2.1 package on the GA media of openSUSE Tumbleweed...

Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

Security Bulletin: PyArrow is vulnerable to CVE-2023-47248 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses PyArrow which is vulnerable to CVE-2023-47248. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-47248 DESCRIPTION: PyArrow could allow a remote authenticated attacker to...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to PyArrow arbitrary code execution vulnerability ( CVE-2023-47248)

Summary Potential PyArrow arbitrary code execution vulnerability has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-47248 DESCRIPTION: PyArrow...