Arrow C++ and PyArrow before 26.0.0 forward unvalidated Parquet KMS URLs
Original title: CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Moderate-severity CVE-2026-92287 hits Parquet decryption users of Arrow C++ and PyArrow; 26.0.0 is unaffected.
Apache Arrow C++ 4.0.0 before 26.0.0 and PyArrow 8.0.0 before 26.0.0 pass Parquet-controlled KMS URLs to a pluggable KmsClient that skips host validation. Arrow C++ 26.0.0 and PyArrow 26.0.0 are unaffected. The issue is rated moderate and applies when readers decrypt Parquet files using a KmsClient. The mailing-list description is cut off after the reader-side behavior.
Unconfirmed: The posted description is truncated, so later impact details are not available.
- Adam Reeve posted the notice on October 19 with severity rated moderate.
- Affected ranges are Arrow C++ 4.0.0 before 26.0.0 and PyArrow 8.0.0 before 26.0.0.
- Both products at 26.0.0 are listed as unaffected.
- The flaw is unvalidated KMS URL pass-through during Parquet decryption.
Impact: Parquet-controlled KMS URLs reach a KmsClient unchecked
| Product | Affected | Fixed in |
|---|---|---|
| Apache Arrow C++ | 4.0.0 before 26.0.0 | 26.0.0 |
| Apache PyArrow | 8.0.0 before 26.0.0 | 26.0.0 |
- 1.Upgrade Apache Arrow C++ and PyArrow to 26.0.0.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92287 | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1 | 8.1 | — |
From the original article
Posted by Adam Reeve on Oct 19 Severity: moderate Affected versions: - Apache Arrow C++ 4. 0. 0 before 26.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.