PatchTheCVEarrow vulnerabilities and fixes
Recent CVEs affecting arrow, with upgrade or downgrade steps. 6 tracked.
arrow has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-02-17. Highest priority: CVE-2024-52338 (score 68/100).
- CVE-2026-25087 HIGH 7.0 UPGRADE Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.
- CVE-2024-52338 CRITICAL 9.8 UPGRADE Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 thro
- CVE-2024-41178 HIGH 7.5 UPGRADE Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.
- CVE-2019-12410 HIGH 7.5 UPGRADE While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow v
- CVE-2019-12408 HIGH 7.5 UPGRADE It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apac
- CVE-2019-11404 HIGH 8.1 UPGRADE arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) ov
FAQ
How do I fix arrow vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is arrow being exploited right now?
None of the tracked arrow CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which arrow CVE should I patch first?
CVE-2024-52338 currently ranks highest (68/100): Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 thro.