Hi,
The following vulnerability was published for apache-arrow.
CVE-2026-92287[0]:
| Pass-through of unvalidated KMS URLs to KMS clients in Apache C++
| Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users
| who read Parquet files and configure Parquet decryption properties
| with a KmsClient implementation. On the reader side, the KMS URL
| can be application-controlled (specified in the KmsConnectionConfig)
| or file-controlled. If the user does not leverage application
| control for this parameter, a file-controlled KMS URL is forwarded
| to a pluggable KmsClient implementation. If the KMS implementation
| does not perform host validation and makes use of the provided KMS
| URL, a KMS token can be sent to a malicious host set by an attacker
| in the file. Users are recommended to upgrade to version
| 26.0.0, which disables this behavior by default and requires that
| users opt-in to it by enabling the read_kms_url flag in
| the DecryptionConfiguration. Users of affected versions are
| recommended to either specify the KMS URL in the KmsConnectionConfig
| when reading files, or ensure any KmsClient implementations validate
| received KMS URLs. Users that opt-in to file-controlled KMS URLs in
| version 26.0.0 and later must ensure KmsClients validate KMS URLs.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-92287
https://www.cve.org/CVERecord?id=CVE-2026-92287
[1] https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57
[2] https://github.com/apache/arrow/issues/51349
[3] https://github.com/apache/arrow/pull/51350
Regards,
Salvatore