You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@arrow.apache.org by ar...@apache.org on 2026/10/20 09:32:54 UTC
(arrow-site) branch adamreeve-patch-1 created (now 12f49b8dedc)
This is an automated email from the ASF dual-hosted git repository.
adamreeve pushed a change to branch adamreeve-patch-1
in repository https://gitbox.apache.org/repos/asf/arrow-site.git
at 12f49b8dedc Document CVE-2026-92287 in release notes
This branch includes the following new commits:
new 12f49b8dedc Document CVE-2026-92287 in release notes
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(arrow-site) 01/01: Document CVE-2026-92287 in release notes
Posted by ar...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
adamreeve pushed a commit to branch adamreeve-patch-1
in repository https://gitbox.apache.org/repos/asf/arrow-site.git
commit 12f49b8dedcc9116574f0573e6125778b037cccb
Author: Adam Reeve <ad...@gmail.com>
AuthorDate: Tue Oct 20 22:32:46 2026 +1300
Document CVE-2026-92287 in release notes
Added a security notice regarding CVE-2026-92287, related to KMS URLs being read from embedded metadata in Parquet files.
---
_posts/2026-10-08-26.0.0-release.md | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/_posts/2026-10-08-26.0.0-release.md b/_posts/2026-10-08-26.0.0-release.md
index 8d1ea38a79a..598756cc105 100644
--- a/_posts/2026-10-08-26.0.0-release.md
+++ b/_posts/2026-10-08-26.0.0-release.md
@@ -93,6 +93,12 @@ using `LoadFileSystemFactories`.
### Parquet
+#### CVE-2026-92287: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
+
+A security issue was fixed where KMS URLs embedded in Parquet files were forwarded to a user-implemented KMS client. This is now disabled by default but can be optionally enabled, in which case users should ensure they validate the KMS URLs received ([GH-51349](https://github.com/apache/arrow/issues/51349)).
+
+See our [separate announcement](https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57) for further detail.
+
The schema nesting depth is now limited when parsing the Thrift metadata of a
Parquet file, turning a stack overflow on pathologically nested schemas into a
regular error ([GH-51238](https://github.com/apache/arrow/issues/51238)). The default limit (100) can be raised if needed.