https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25087.htmlhttps://patchthecve.com/cve/CVE-2026-25087.htmlWed, 17 Jun 2026 10:24:05 +0000HIGH 7.0: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and Strinhttps://patchthecve.com/cve/CVE-2024-52338.htmlhttps://patchthecve.com/cve/CVE-2024-52338.htmlWed, 17 Jun 2026 08:07:02 +0000CRITICAL 9.8: Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). Thihttps://patchthecve.com/cve/CVE-2024-41178.htmlhttps://patchthecve.com/cve/CVE-2024-41178.htmlWed, 17 Jun 2026 07:47:25 +0000HIGH 7.5: Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens.  On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity https://docs.aws.amazonhttps://patchthecve.com/cve/CVE-2019-12410.htmlhttps://patchthecve.com/cve/CVE-2019-12410.htmlWed, 17 Jun 2026 02:14:35 +0000HIGH 7.5: While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory cohttps://patchthecve.com/cve/CVE-2019-12408.htmlhttps://patchthecve.com/cve/CVE-2019-12408.htmlWed, 17 Jun 2026 02:14:35 +0000HIGH 7.5: It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrahttps://patchthecve.com/cve/CVE-2019-11404.htmlhttps://patchthecve.com/cve/CVE-2019-11404.htmlWed, 17 Jun 2026 02:12:51 +0000HIGH 8.1: arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.