crates.io arrow-data vulnerabilities

Latest crates.io arrow-data CVEs

Newest publication first

1. CVE-2026-111959 Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

   Published 2026-11-02

   Critical·CVSS 9.1 EPSS 0.55%

   Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values arra...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.