repository icon
apache / arrow Project repository

Apache Arrow is the universal columnar format and multi-language toolbox for fast data interchange and in-memory analytics

Submit a report

FIRST INTERACTION

WITHIN7 DAYS

REVIEW

WITHIN11 DAYS

FIX

WITHIN56 DAYS

Path Traversal in DirectoryPartitioning and FilenamePartitioning Dataset Writing
mscgo
self closed
Unsafe tarfile extraction without path validation in download_tzdata_on_windows(...
elucidator-hky
self closed
[CWE-190] Integer Overflow in int32_t offset in Parquet ByteArray/FLBA Dictionar...
shima-coder
duplicate
Critical
Out-of-Bounds Read via Integer Truncation in Arrow Flight gRPC FlightData Deseri...
hiyokosauna37
self closed
Apache Arrow IPC fixed_shape_tensor extension metadata validation bypass leads t...
4ur0n
self closed
Remote Code Execution via Integer Overflow in Apache Arrow Parquet Decoder
1135
informative
High
Apache Arrow C++ IPC: forged RecordBatch/FieldNode lengths cause OOB read with c...
jaenact
informative
Medium
Out-of-Bounds Read in Apache Arrow C++ IPC Deserialization Due to Missing Buffer...
jaenact
informative
Medium
Remote Code Execution (RCE) via Automatic Extension Type Deserialization in Arro...
bademeischta
informative
Critical
Integer Overflow leading to Heap Buffer Overflow in Gandiva repeat() function
ahmetartuc
informative
High
Out-of-Bounds Dictionary Index in Arrow IPC Leads to Memory Disclosure and DoS
34selen
duplicate
High
Apache Arrow IPC cached prebuffer path triggers signed integer overflow UB in re...
rootkid19
Medium
•$100
Directory-Traversal in pyarrow.fs.SubTreeFileSystem lets attackers escape the co...
v4yne1
not applicable
YAML Deserialization Vulnerability via Job Submission
shadowbyte1
self closed
Branch protection misconfigured for branch 'main'
dmandefy
informative
High
native command injection vulnerability in apache arrow project , which can be u...
carnival-z
informative
Critical
An unverified deserialized data stream of function trust was found in arrow pro...
carnival-z
informative
Critical
Apache arrow command execution vulnerability
laoquanshi
High
•$2250•CVE-2023-47248