Arrow (Apache) - vulnerabilities (CVEs)

6 CVEs, 1 in the last 30 days, 103 known versions, newest CVE from 2026-10-22. Vendor: Apache.

CVEs of Arrow

• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2026-25087 - CVSS 7 (high), 2026-02-17: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow…
• CVE-2024-52338 - CVSS 9.8 (critical), 2024-11-28: Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An…
• CVE-2024-41178 - CVSS 7.5 (high), 2024-07-23: Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS…
• CVE-2019-12410 - CVSS 7.5 (high), 2019-11-08: While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data…
• CVE-2019-12408 - CVSS 7.5 (high), 2019-11-08: It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized…