Vulnerability-Lookup

RUSTSEC-2026-0442 (CVE-2026-111959)

Vulnerability from osv_rustsec – Published: 2026-11-02 12:00 – Updated: 2026-11-05 08:50 – Source website

Summary

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Details

Improper validation of RunEndEncoded arrays via ArrayData::validate_values can allow reading data beyond the bounds of the child values array when reading the last value via APIs such as TypedRunArray::value.

Patched versions now properly validate the contents of RunEndEncoded arrays to prevent allowing reading out of bounds of the specified array data.

Credit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding this.

References

URL

Type

	https://crates.io/crates/arrow-data	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0442.html	ADVISORY
	https://github.com/apache/arrow-rs/issues/11587	REPORT
	https://www.openwall.com/lists/oss-security/2026/…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-exposure"
        ],
        "cvss": null,
        "informational": "unsound"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "arrow-data",
        "purl": "pkg:cargo/arrow-data"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "33.0.0"
            },
            {
              "fixed": "57.3.2"
            },
            {
              "introduced": "58.0.0"
            },
            {
              "fixed": "58.4.1"
            },
            {
              "introduced": "59.0.0"
            },
            {
              "fixed": "59.3.2"
            },
            {
              "introduced": "60.0.0"
            },
            {
              "fixed": "60.1.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-111959",
    "GHSA-gqmm-qrjq-4c7h"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Improper validation of RunEndEncoded arrays via `ArrayData::validate_values` can\nallow reading data beyond the bounds of the child values array when reading the\nlast value via APIs such as `TypedRunArray::value`.\n\nPatched versions now properly validate the contents of RunEndEncoded arrays to prevent\nallowing reading out of bounds of the specified array data.\n\nCredit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding\nthis.",
  "id": "RUSTSEC-2026-0442",
  "modified": "2026-11-05T08:50:49Z",
  "published": "2026-11-02T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/arrow-data"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0442.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/apache/arrow-rs/issues/11587"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/11/02/2"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads"
}

CVE-2026-111959 (GCVE-0-2026-111959)

Vulnerability from cvelistv5 – Published: 2026-11-02 13:34 – Updated: 2026-11-06 18:35

Title

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Summary

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:35 UTC

CWE

CWE-125 - Out-of-bounds read
CWE-20 - Improper input validation

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1176 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread.html/hnlrdk4w99b1…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/11/02/2

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Arrow Rust	Affected: 60.0.0 , < 60.1.0 (semver) Affected: 59.0.0 , ≤ 59.3.1 (semver) Affected: 58.0.0 , ≤ 58.4.0 (semver) Affected: 33.0.0 , ≤ 57.3.1 (semver)

Credits

Adam Korczynski of Ada Logics Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-02T20:05:09.522Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/02/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-111959",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:35:18.470735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:35:40.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://crates.io",
          "defaultStatus": "unaffected",
          "packageName": "arrow",
          "packageURL": "pkg:cargo/arrow",
          "product": "Apache Arrow Rust",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "60.1.0",
              "status": "affected",
              "version": "60.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "59.3.1",
              "status": "affected",
              "version": "59.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "58.4.0",
              "status": "affected",
              "version": "58.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "57.3.1",
              "status": "affected",
              "version": "33.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Adam Korczynski of Ada Logics"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOut-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\u003c/p\u003e\u003cp\u003eImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T13:34:17.835Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-111959",
    "datePublished": "2026-11-02T13:34:17.835Z",
    "dateReserved": "2026-10-17T16:33:55.330Z",
    "dateUpdated": "2026-11-06T18:35:40.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-GQMM-QRJQ-4C7H

Vulnerability from github – Published: 2026-11-02 15:31 – Updated: 2026-11-02 21:31

Details

Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.

Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.

Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-111959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-02T14:17:35Z",
    "severity": null
  },
  "details": "Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.",
  "id": "GHSA-gqmm-qrjq-4c7h",
  "modified": "2026-11-02T21:31:51Z",
  "published": "2026-11-02T15:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111959"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/11/02/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RUSTSEC-2026-0442 (CVE-2026-111959)

CVE-2026-111959 (GCVE-0-2026-111959)

GHSA-GQMM-QRJQ-4C7H

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour