As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
CVE-2026-92287 affects Apache Arrow C++ and PyArrow versions 4.0.0 through 25.0.1, in which unvalidated key management service (KMS) URLs from Parquet files are passed to pluggable KMS client implementations without host validation. Version 26.0.0 and later are unaffected. This vulnerability exposes systems that decrypt Parquet files with a custom KMS client to potential URL spoofing attacks.
Why it matters: Organizations using PyArrow or Apache Arrow C++ to read encrypted Parquet files with a pluggable KMS client should patch to version 26.0.0 or later, as an attacker controlling a Parquet file could redirect key requests to an unauthorized server.
- Source published
- First seen by Cybersecurity Tracker