repository icon
apache / arrow Project repository

Apache Arrow is the universal columnar format and multi-language toolbox for fast data interchange and in-memory analytics

Submit a report

FIRST INTERACTION

WITHIN19 DAYS

REVIEW

WITHIN17 DAYS

FIX

WITHIN56 DAYS

Parquet Page Reader Uncapped uncompressed_page_size Allocation Causes OOM DoS
jd-admrl-ai
self closed
Out-of-bounds heap write in Arrow IPC sparse tensor deserialization allows remot...
linziyuu
pending
Denial of Service in Arrow sparse tensor IPC parsing allows remote abort via mis...
linziyuu
pending
Denial of Service in Arrow IPC sparse tensor deserialization allows remote proce...
linziyuu
pending
Out-of-Bounds Heap Write in Apache Arrow C++ IPC CSF SparseTensor Parser (ReadSp...
linziyuu
pending
arrow-glib public getters return dangling GBytes over freed Arrow memory, enabli...
shadowbyte1
pending
Feather V1 reader skips flatbuffers verification and trusts attacker-controlled...
snakeyworm
pending
Substrait emit.output_mapping index OOB
kotori2
pending
ReadTensor out-of-bounds read
kotori2
pending
IPC Decompression Bomb via Unchecked uncompressed_size Field Causes OOM (DoS)
skillwager
pending
Stack Overflow via Unbounded Recursion in Parquet Schema Parsing (DoS)
skillwager
pending
Feather V1 reader deserializes unverified Flatbuffer metadata, leading to invali...
jasanpes
pending
Heap buffer over-read via negative byte_width in pa.binary() — process crash
javitoia
self closed
Heap-use-after-free in BackpressureConcurrentQueue::Push() due to unsynchronize...
ahmtbrt07
pending
Improper Error Handling in Dataset Destination Validation Leads to Unsafe Write...
libinbtc
pending
Tarfile path traversal in timezone data download via tarfile.extractall()
manja316
pending
Decompression Bomb via Attacker-Controlled uncompressed_size in Arrow IPC Reader
ryanhugh-security-fanpierlabs
pending
Integer Overflow and Heap OOB Read in Apache Arrow Feather V1 Reader
ryanhugh-security-fanpierlabs
pending
Signed Integer Overflow in CSV Parser PresizedValueDescWriter causes undersized...
cyberwael
pending
Arbitrary File Overwrite via Path Traversal in Dataset Partitioning (DirectoryPa...
hyperps
pending
Integer overflow in multiple compute kernels and array builders leads to heap bu...
nhomyk
pending
Missing Upper Bound Validation on FLBA type_length in Parquet Schema Parser
javitoia
not applicable
Silent int32 Offset Truncation in ReplaceSubstring Kernel Causes Data Corruption
javitoia
self closed
Out-of-Bounds Read via NoBoundsCheck Take in CastVarToFixedList
javitoia
self closed
Integer Overflow in CastFixedToVarList Offset Computation Leads to Silent Data C...
javitoia
self closed
Uncontrolled Memory Allocation in Parquet Decoder leading to Denial of Service (...
sivaadityacoder
pending
Malformed ORC UNION tag causes SIGSEGV DoS in apache/arrow ORC deserialization
thang-md
pending
Path Traversal in DirectoryPartitioning and FilenamePartitioning Dataset Writing
mscgo
self closed
Apache Arrow run_end_decode trusts malformed run ends, leading to negative run l...
thang-md
pending
Unsafe tarfile extraction without path validation in download_tzdata_on_windows(...
elucidator-hky
self closed
Gandiva: Heap Out-of-Bounds Write in gdv_hash_using_openssl + Arena Allocator In...
kimngocchung
informative
Critical
[CWE-125] Heap Buffer Over-Read in SparseCOO/CSF Index Deserialization — Missing...
shima-coder
pending
[CWE-197] Integer Truncation of Parent Indices in list_parent_indices for FixedS...
shima-coder
pending
[CWE-190] Integer Overflow in ListParentIndicesArray::Visit(FixedSizeListType) —...
shima-coder
pending
[CWE-681] Integer Truncation size_t→int32_t in NumPy Binary/String Array Convert...
shima-coder
not applicable
[CWE-681] Integer Truncation Py_ssize_t→int32_t in Dictionary String/Binary Conv...
shima-coder
pending
[CWE-787] Heap Buffer Overflow in ReadSparseCSFIndex via Unchecked indptrBuffers...
shima-coder
pending
[CWE-190] Integer Overflow in SparseTensor CSX indptr shape computation leads to...
shima-coder
pending
[CWE-190] Integer Overflow in Sparse Tensor Index Buffer Size Validation Leads t...
shima-coder
duplicate
Critical
[CWE-190] Integer Overflow in SparseCSXIndex::Make shape[N]+1 computation leads...
shima-coder
pending
[CWE-190] Integer Overflow in SparseTensor IPC Deserialization Bypasses Buffer S...
shima-coder
pending
[CWE-190] Integer Overflow in Sparse Tensor Buffer Validation Allows Heap Out-of...
shima-coder
duplicate
Critical
[CWE-125] Out-of-bounds Heap Read via Missing Flatbuffer Verification in Feather...
shima-coder
duplicate
Critical
[CWE-190] Integer Overflow in Sparse Tensor IPC Deserialization Leads to Out-of-...
shima-coder
pending
[CWE-190] Integer Overflow in Sparse CSX/COO Tensor IPC Deserialization Bypasses...
shima-coder
pending
[CWE-190] Multiple Integer Overflows in Sparse Tensor IPC Deserialization Lead t...
shima-coder
pending
[CWE-125] Heap Buffer Under-Read via Missing Negative Offset Validation in Valid...
shima-coder
duplicate
High
[CWE-190] Integer Overflow in int32_t offset in Parquet ByteArray/FLBA Dictionar...
shima-coder
duplicate
Critical
[CWE-125] Missing Negative Offset Validation in ArrayData Allows Heap Buffer Ove...
shima-coder
duplicate
Critical
Apache Arrow Flight DoPut fixed_shape_tensor negative-shape metadata causes serv...
4ur0n
pending
Out-of-Bounds Read via Integer Truncation in Arrow Flight gRPC FlightData Deseri...
hiyokosauna37
self closed
Apache Arrow IPC fixed_shape_tensor extension metadata validation bypass leads t...
4ur0n
self closed
Assertion-triggered process abort (DoS) in `ReadSparseTensorPayload` via attacke...
maru1009
pending
Out-of-bounds write/read in sparse tensor densification (`SparseTensor::ToTensor...
maru1009
duplicate
Critical
Systemic Integer Overflow in Gandiva String Functions (lower, upper, initcap, tr...
2201029-cyber
informative
High
Heap Out-of-Bounds Write via Size Mismatch in SparseTensor CSF Index Deserializa...
zerojackyi
pending
Arbitrary File Write (Zip Slip) in `download_tzdata_on_windows` via unvalidated...
zitoxxx
not applicable
Process Crash via Corrupted Buffer Length in Arrow IPC Stream RecordBatch Metada...
baguette168
pending
Remote Code Execution via Integer Overflow in Apache Arrow Parquet Decoder
1135
informative
High
Use-After-Free in Arrow Flight SQL ODBC Driver via Unsafe Handle Lifecycle (odbc...
cr-itamarhershko
pending
Apache Arrow C++ IPC: forged RecordBatch/FieldNode lengths cause OOB read with c...
jaenact
informative
Medium
Out-of-Bounds Read and Integer Underflow lead to Memory Corruption in Dataset Pa...
sandeepwawdane
duplicate
High
NULL Pointer Dereference leads to DOS in Parquet StreamReader when processing ze...
sandeepwawdane
informative
Medium
Integer Overflow in Apache Arrow Flight RPC UnpackProtoAction Causes Memory Corr...
sandeepwawdane
pending
Out-of-Bounds Read in Apache Arrow C++ IPC Deserialization Due to Missing Buffer...
jaenact
informative
Medium
Uncontrolled Memory Allocation in Apache Arrow IPC leading to Remote Denial of S...
ahmtbrt07
duplicate
High
Remote Code Execution (RCE) via Automatic Extension Type Deserialization in Arro...
bademeischta
informative
Critical
Integer Overflow leading to Heap Buffer Overflow in Gandiva repeat() function
ahmetartuc
informative
High
Uncontrolled Memory Allocation in IPC Reader leading to DoS (BinaryViewType)
bademeischta
duplicate
High
Out-of-Bounds Dictionary Index in Arrow IPC Leads to Memory Disclosure and DoS
34selen
duplicate
High
Apache Arrow IPC cached prebuffer path triggers signed integer overflow UB in re...
rootkid19
Medium
•$100
Directory-Traversal in pyarrow.fs.SubTreeFileSystem lets attackers escape the co...
v4yne1
not applicable
YAML Deserialization Vulnerability via Job Submission
shadowbyte1
self closed
Branch protection misconfigured for branch 'main'
dmandefy
informative
High
native command injection vulnerability in apache arrow project , which can be u...
carnival-z
informative
Critical
An unverified deserialized data stream of function trust was found in arrow pro...
carnival-z
informative
Critical
Apache arrow command execution vulnerability
laoquanshi
High
•$2250•CVE-2023-47248