EUVD-2025-29424

Malicious code in bioql PyPI...

GHSA-WV8J-M3HX-924J Arrow2 allows out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

anndata (0.2.0), anndata-hdf5 (>=0.1.0, <=0.1.1) +102 more potentially affected by unknown CVE via arrow2 (>=0.5.3, <=0.17.4)

arrow2 CARGO version =0.5.3, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.2.1, =0.2.2, =0.4.0, =0.1.0, =0.15.0, =0.16.0 - geoarrow-wasm 0.1.0 - geoarrow2 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WV8J-M3HX-924J...

Arrow2 allows out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

PT-2025-24602 · Crates.Io · Arrow2

Rows::row unchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

RUSTSEC-2025-0038 Out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

alloy-rs (0.2.1), anndata (0.2.0) +113 more potentially affected by unknown CVE via arrow2 (>=0.5.3, <=0.18.0)

arrow2 CARGO version =0.5.3, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.0.1, =0.1.0, =0.2.1, =0.2.2, =0.4.0, =0.1.0, =0.1.0, =0.1.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0038...

Out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

PT-2025-23365 · Crates.Io · Arrow2

Rows::row unchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

Arrow2 allows double free in `safe` code

The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...

bibjoin (>=0.2.2, <=0.3.0), idhash (0.1.3) +9 more potentially affected by unknown CVE via arrow2 (>=0.5.3, <=0.6.2)

arrow2 CARGO version =0.5.3, =0.2.2, =0.38.0, =0.38.0, =0.39.0 - polars 0.16.0 - polars-arrow 0.16.0 - polars-core 0.16.0 - polars-io 0.16.0 - polars-lazy 0.16.0 - rinfluxdb 0.2.0 - rinfluxdb-polars 0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-5J8W-R7G8-5472...

GHSA-5J8W-R7G8-5472 Arrow2 allows double free in `safe` code

The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...

bibjoin (>=0.2.2, <=0.3.0), idhash (0.1.3) +9 more potentially affected by unknown CVE via arrow2 (>=0.5.3, <=0.6.2)

arrow2 CARGO version =0.5.3, =0.2.2, =0.38.0, =0.38.0, =0.39.0 - polars 0.16.0 - polars-arrow 0.16.0 - polars-core 0.16.0 - polars-io 0.16.0 - polars-lazy 0.16.0 - rinfluxdb 0.2.0 - rinfluxdb-polars 0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0012...

RUSTSEC-2022-0012 Arrow2 allows double free in `safe` code

The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...

Arrow2 allows double free in `safe` code

The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...