arrow vulnerabilities

CVEs whose affected-version data names the arrow package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111959Critical· 9.1

6d ago

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading…

▾ MidnightApache Software Foundation · arrowEPSS 0.55%via CVEORG