repository icon
apache / arrow Project repository

Apache Arrow is the universal columnar format and multi-language toolbox for fast data interchange and in-memory analytics

Submit a report

FIRST INTERACTION

WITHIN18 DAYS

REVIEW

WITHIN17 DAYS

FIX

WITHIN56 DAYS

Parquet Page Reader Uncapped uncompressed_page_size Allocation Causes OOM DoS
jd-admrl-ai
self closed
Heap buffer over-read via negative byte_width in pa.binary() — process crash
javitoia
self closed
Missing Upper Bound Validation on FLBA type_length in Parquet Schema Parser
javitoia
not applicable
Silent int32 Offset Truncation in ReplaceSubstring Kernel Causes Data Corruption
javitoia
self closed
Out-of-Bounds Read via NoBoundsCheck Take in CastVarToFixedList
javitoia
self closed
Integer Overflow in CastFixedToVarList Offset Computation Leads to Silent Data C...
javitoia
self closed
Malformed ORC UNION tag causes SIGSEGV DoS in apache/arrow ORC deserialization
thang-md
pending
Path Traversal in DirectoryPartitioning and FilenamePartitioning Dataset Writing
mscgo
self closed
Apache Arrow run_end_decode trusts malformed run ends, leading to negative run l...
thang-md
pending
Unsafe tarfile extraction without path validation in download_tzdata_on_windows(...
elucidator-hky
self closed
Gandiva: Heap Out-of-Bounds Write in gdv_hash_using_openssl + Arena Allocator In...
kimngocchung
informative
Critical
[CWE-125] Heap Buffer Over-Read in SparseCOO/CSF Index Deserialization — Missing...
shima-coder
pending
[CWE-197] Integer Truncation of Parent Indices in list_parent_indices for FixedS...
shima-coder
pending
[CWE-190] Integer Overflow in ListParentIndicesArray::Visit(FixedSizeListType) —...
shima-coder
pending
[CWE-681] Integer Truncation size_t→int32_t in NumPy Binary/String Array Convert...
shima-coder
not applicable
[CWE-681] Integer Truncation Py_ssize_t→int32_t in Dictionary String/Binary Conv...
shima-coder
pending
[CWE-787] Heap Buffer Overflow in ReadSparseCSFIndex via Unchecked indptrBuffers...
shima-coder
pending
[CWE-190] Integer Overflow in SparseTensor CSX indptr shape computation leads to...
shima-coder
pending
[CWE-190] Integer Overflow in Sparse Tensor Index Buffer Size Validation Leads t...
shima-coder
duplicate
Critical
[CWE-190] Integer Overflow in SparseCSXIndex::Make shape[N]+1 computation leads...
shima-coder
pending
[CWE-190] Integer Overflow in SparseTensor IPC Deserialization Bypasses Buffer S...
shima-coder
pending
[CWE-190] Integer Overflow in Sparse Tensor Buffer Validation Allows Heap Out-of...
shima-coder
duplicate
Critical
[CWE-125] Out-of-bounds Heap Read via Missing Flatbuffer Verification in Feather...
shima-coder
duplicate
Critical
[CWE-190] Integer Overflow in Sparse Tensor IPC Deserialization Leads to Out-of-...
shima-coder
pending
[CWE-190] Integer Overflow in Sparse CSX/COO Tensor IPC Deserialization Bypasses...
shima-coder
pending
[CWE-190] Multiple Integer Overflows in Sparse Tensor IPC Deserialization Lead t...
shima-coder
pending
[CWE-125] Heap Buffer Under-Read via Missing Negative Offset Validation in Valid...
shima-coder
duplicate
High
[CWE-190] Integer Overflow in int32_t offset in Parquet ByteArray/FLBA Dictionar...
shima-coder
duplicate
Critical
[CWE-125] Missing Negative Offset Validation in ArrayData Allows Heap Buffer Ove...
shima-coder
duplicate
Critical
Apache Arrow Flight DoPut fixed_shape_tensor negative-shape metadata causes serv...
4ur0n
pending
Out-of-Bounds Read via Integer Truncation in Arrow Flight gRPC FlightData Deseri...
hiyokosauna37
self closed
Apache Arrow IPC fixed_shape_tensor extension metadata validation bypass leads t...
4ur0n
self closed
Assertion-triggered process abort (DoS) in `ReadSparseTensorPayload` via attacke...
maru1009
pending
Out-of-bounds write/read in sparse tensor densification (`SparseTensor::ToTensor...
maru1009
duplicate
Critical
Systemic Integer Overflow in Gandiva String Functions (lower, upper, initcap, tr...
2201029-cyber
informative
High
Heap Out-of-Bounds Write via Size Mismatch in SparseTensor CSF Index Deserializa...
zerojackyi
pending
Arbitrary File Write (Zip Slip) in `download_tzdata_on_windows` via unvalidated...
zitoxxx
not applicable
Process Crash via Corrupted Buffer Length in Arrow IPC Stream RecordBatch Metada...
baguette168
pending
Remote Code Execution via Integer Overflow in Apache Arrow Parquet Decoder
1135
informative
High
Use-After-Free in Arrow Flight SQL ODBC Driver via Unsafe Handle Lifecycle (odbc...
cr-itamarhershko
pending
Apache Arrow C++ IPC: forged RecordBatch/FieldNode lengths cause OOB read with c...
jaenact
informative
Medium
Out-of-Bounds Read and Integer Underflow lead to Memory Corruption in Dataset Pa...
sandeepwawdane
duplicate
High
NULL Pointer Dereference leads to DOS in Parquet StreamReader when processing ze...
sandeepwawdane
informative
Medium
Integer Overflow in Apache Arrow Flight RPC UnpackProtoAction Causes Memory Corr...
sandeepwawdane
pending
Out-of-Bounds Read in Apache Arrow C++ IPC Deserialization Due to Missing Buffer...
jaenact
informative
Medium
Uncontrolled Memory Allocation in Apache Arrow IPC leading to Remote Denial of S...
ahmtbrt07
duplicate
High
Remote Code Execution (RCE) via Automatic Extension Type Deserialization in Arro...
bademeischta
informative
Critical
Integer Overflow leading to Heap Buffer Overflow in Gandiva repeat() function
ahmetartuc
informative
High
Uncontrolled Memory Allocation in IPC Reader leading to DoS (BinaryViewType)
bademeischta
duplicate
High
Out-of-Bounds Dictionary Index in Arrow IPC Leads to Memory Disclosure and DoS
34selen
duplicate
High
Apache Arrow IPC cached prebuffer path triggers signed integer overflow UB in re...
rootkid19
Medium
•$100
Directory-Traversal in pyarrow.fs.SubTreeFileSystem lets attackers escape the co...
v4yne1
not applicable
YAML Deserialization Vulnerability via Job Submission
shadowbyte1
self closed
Branch protection misconfigured for branch 'main'
dmandefy
informative
High
native command injection vulnerability in apache arrow project , which can be u...
carnival-z
informative
Critical
An unverified deserialized data stream of function trust was found in arrow pro...
carnival-z
informative
Critical
Apache arrow command execution vulnerability
laoquanshi
High
•$2250•CVE-2023-47248