repository icon
apache / arrow Project repository

Apache Arrow is the universal columnar format and multi-language toolbox for fast data interchange and in-memory analytics

Submit a report

FIRST INTERACTION

WITHIN12 DAYS

REVIEW

WITHIN19 DAYS

FIX

WITHIN56 DAYS

Parquet Page Reader Uncapped uncompressed_page_size Allocation Causes OOM DoS
jd-admrl-ai
self closed
Heap buffer over-read via negative byte_width in pa.binary() — process crash
javitoia
self closed
Missing Upper Bound Validation on FLBA type_length in Parquet Schema Parser
javitoia
not applicable
Silent int32 Offset Truncation in ReplaceSubstring Kernel Causes Data Corruption
javitoia
self closed
Out-of-Bounds Read via NoBoundsCheck Take in CastVarToFixedList
javitoia
self closed
Integer Overflow in CastFixedToVarList Offset Computation Leads to Silent Data C...
javitoia
self closed
Path Traversal in DirectoryPartitioning and FilenamePartitioning Dataset Writing
mscgo
self closed
Unsafe tarfile extraction without path validation in download_tzdata_on_windows(...
elucidator-hky
self closed
Gandiva: Heap Out-of-Bounds Write in gdv_hash_using_openssl + Arena Allocator In...
kimngocchung
informative
Critical
[CWE-681] Integer Truncation size_t→int32_t in NumPy Binary/String Array Convert...
shima-coder
not applicable
[CWE-190] Integer Overflow in int32_t offset in Parquet ByteArray/FLBA Dictionar...
shima-coder
duplicate
Critical
Out-of-Bounds Read via Integer Truncation in Arrow Flight gRPC FlightData Deseri...
hiyokosauna37
self closed
Apache Arrow IPC fixed_shape_tensor extension metadata validation bypass leads t...
4ur0n
self closed
Systemic Integer Overflow in Gandiva String Functions (lower, upper, initcap, tr...
2201029-cyber
informative
High
Arbitrary File Write (Zip Slip) in `download_tzdata_on_windows` via unvalidated...
zitoxxx
not applicable
Remote Code Execution via Integer Overflow in Apache Arrow Parquet Decoder
1135
informative
High
Apache Arrow C++ IPC: forged RecordBatch/FieldNode lengths cause OOB read with c...
jaenact
informative
Medium
NULL Pointer Dereference leads to DOS in Parquet StreamReader when processing ze...
sandeepwawdane
informative
Medium
Out-of-Bounds Read in Apache Arrow C++ IPC Deserialization Due to Missing Buffer...
jaenact
informative
Medium
Uncontrolled Memory Allocation in Apache Arrow IPC leading to Remote Denial of S...
ahmtbrt07
duplicate
High
Remote Code Execution (RCE) via Automatic Extension Type Deserialization in Arro...
bademeischta
informative
Critical
Integer Overflow leading to Heap Buffer Overflow in Gandiva repeat() function
ahmetartuc
informative
High
Uncontrolled Memory Allocation in IPC Reader leading to DoS (BinaryViewType)
bademeischta
duplicate
High
Out-of-Bounds Dictionary Index in Arrow IPC Leads to Memory Disclosure and DoS
34selen
duplicate
High
Apache Arrow IPC cached prebuffer path triggers signed integer overflow UB in re...
rootkid19
Medium
•$100
Directory-Traversal in pyarrow.fs.SubTreeFileSystem lets attackers escape the co...
v4yne1
not applicable
YAML Deserialization Vulnerability via Job Submission
shadowbyte1
self closed
Branch protection misconfigured for branch 'main'
dmandefy
informative
High
native command injection vulnerability in apache arrow project , which can be u...
carnival-z
informative
Critical
An unverified deserialized data stream of function trust was found in arrow pro...
carnival-z
informative
Critical
Apache arrow command execution vulnerability
laoquanshi
High
•$2250•CVE-2023-47248