PyArrow vulnerabilities

2 known vulnerabilities in PyArrow from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions…

  CVE-2026-92287Oct 20, 2026Apache

  Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side, the KMS U

• 9.8 Critical severity

  PyArrow: Deserialization of Untrusted Data

  CVE-2023-47248Nov 9, 2023ApacheEPSS 13.2%

  Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied inp