PyArrow Flight RPC - Remote Code Execution

PyArrow Flight RPC from v0.14.0 through v14.0.0 allows remote attackers to execute arbitrary code via a maliciously crafted Python-defined extension type. id: CVE-2023-47248 info: name: PyArrow Flight RPC - Remote Code Execution author: smolse severity: critical description: | PyArrow Flight RPC...

UBUNTU-CVE-2026-92287

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

ROOT-APP-PYPI-CVE-2023-47248 CVE-2023-47248 in pyarrow - Patched by Root

Root has patched CVE-2023-47248 in the pyarrow package for Root:PyPI. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-92287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and...

SUSE CVE-2026-92287

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

3lc (>=2.3.84, <=2.15.0), 3m (>=0.1.0, <=0.1.3) +4119 more potentially affected by CVE-2026-92287 via pyarrow (>=8.0.0, <=25.0.1)

pyarrow PYPI version =8.0.0, =2.3.84, =0.1.0, =0.1.3, =6.13.1, =1.0.0, =9.273.1, =2.0.0, =1.1.0, =0.1.0, =0.10.1, =0.1.7, =2.0.4, =0.0.1, =0.0.13 and more Source cves: CVE-2026-92287 Source advisory: SNYK:PYTHON-PYARROW-21279727...

External Control of System or Configuration Setting

Overview pyarrow is a Python API for functionality provided by the Arrow C++ libraries, along with tools for Arrow integration and interoperability with pandas, NumPy, and other software in the Python ecosystem. Affected versions of this package are vulnerable to External Control of System or...

CVE-2026-92287

A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service KMS client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implementation. An attacker can supply a maliciously crafted Parqu...

DEBIAN-CVE-2026-92287

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

AZL-109896 CVE-2026-92287 affecting package ceph 18.2.2-13

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

AZL-110001 CVE-2026-92287 affecting package libarrow 15.0.0-9

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

3m (>=0.1.0, <=0.1.3), abadpour (>=6.13.1, <=7.24.1) +1171 more potentially affected by CVE-2026-92287 via pyarrow (>=25.0.0, <=25.0.1)

pyarrow PYPI version =25.0.0, =0.1.0, =6.13.1, =9.273.1, =2.0.0, =0.1.0, =0.1.7, =0.0.2, =0.0.1, =0.0.1, =0.1.0, =0.9.0, =1.0.0 and more Source cves: CVE-2026-92287 Source advisory: MEND:CVE-2026-92287...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

A vulnerability exists in Apache C++ Parquet and PyArrow (versions 4.0.0 to 25.0.1) where unvalidated KMS URLs embedded in Parquet files are passed to pluggable KmsClient implementations. If a user does not specify a KMS URL in the KmsConnectionConfig, the application falls back to the file-contr...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

EUVD-2026-104836

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...

CVE-2026-92287 Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS URL can be application-controlled...