Arrow
Monthly
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compressed stream can trigger an out-of-bounds write when decompressed, corrupting memory in the process handling the data. Exposure is limited to deployments that actually pass attacker-controlled brotli data into the decoder - for example services honouring Content-Encoding: br on untrusted requests or responses, or applications calling zlib.brotliDecompress/BrotliDecompress on untrusted input - and no authentication or user interaction is required in that scenario. The flaw is rated High with a CVSS 4.0 score of 9.2 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), no CISA KEV listing confirms active exploitation, and a public PoC reference exists but is not verified as working exploit code; the vendor fix is Node.js v26.12.1, released 2026-10-21.
Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. [CVSS 7.0 HIGH]
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Remote code execution is possible in Node.js releases that bundle a vulnerable Brotli decoder: a malformed brotli-compressed stream can trigger an out-of-bounds write when decompressed, corrupting memory in the process handling the data. Exposure is limited to deployments that actually pass attacker-controlled brotli data into the decoder - for example services honouring Content-Encoding: br on untrusted requests or responses, or applications calling zlib.brotliDecompress/BrotliDecompress on untrusted input - and no authentication or user interaction is required in that scenario. The flaw is rated High with a CVSS 4.0 score of 9.2 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), no CISA KEV listing confirms active exploitation, and a public PoC reference exists but is not verified as working exploit code; the vendor fix is Node.js v26.12.1, released 2026-10-21.
Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. [CVSS 7.0 HIGH]
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.