Posted by Jeffrey Vo on Nov 02 Severity: moderate Affected versions: - Apache Arrow Rust 60.0.0 before 60.1.0 - Apache Arrow Rust 59.0.0 through 59.3.1 - Apache Arrow Rust 58.0.0 through 58.4.0 - Apache Arrow Rust 33.0.0 through 57.3.1 Description: Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can...
CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/465
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 -…
CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.12 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 - Apache…
CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership
Posted by Arnout Engelen on Nov 02 Severity: moderate Affected versions: - Apache Oozie: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper input…
CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing
Posted by Arnout Engelen on Nov 02 Severity: moderate Affected versions: - Apache JClouds: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction…
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them…
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Posted by Jens Geyer on Oct 30 Severity: important CVSS 4.0: 8.2 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache…