parquet-avro-rce

Este repositorio no tiene un README...

CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types ray.data.arrowtensor, ray.data.arrowtensorv2, ray.data.arrowvariableshapedtensor globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension type...

PT-2023-7023

Name of the Vulnerable Software and Affected Versions PyArrow versions 0.14.0 through 14.0.0 Description The issue is related to the deserialization of untrusted data in IPC and Parquet readers, allowing arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather, or...

PYSEC-2019-196

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory...