RUSTSEC-2026-0442

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0442

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0442.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0442

Aliases

CVE-2026-111959
GHSA-gqmm-qrjq-4c7h

Published

2026-11-02T12:00:00Z

Modified

2026-11-05T09:00:02Z

Summary

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Details

Improper validation of RunEndEncoded arrays via ArrayData::validate_values can allow reading data beyond the bounds of the child values array when reading the last value via APIs such as TypedRunArray::value.

Patched versions now properly validate the contents of RunEndEncoded arrays to prevent allowing reading out of bounds of the specified array data.

Credit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding this.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / arrow-data

Package

Name: arrow-data; View open source insights on deps.dev
Purl: pkg:cargo/arrow-data

Affected ranges

Type: SEMVER
Events: Introduced

33.0.0

Fixed

57.3.2

Introduced

58.0.0

Fixed

58.4.1

Introduced

59.0.0

Fixed

59.3.2

Introduced

60.0.0

Fixed

60.1.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}