Skip to content

LCORE-2011: PyArrow overrides [Konflux] #1925

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tisnik wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

LCORE-2011: PyArrow overrides [Konflux] #1925

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .konflux/requirements.overrides.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ cryptography==46.0.7
anyio==4.12.1
# datasets==4.5.0
pandas==2.3.3
pyarrow==23.0.0
pyarrow==23.0.1

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

PyArrow 23.0.1 release notes security fixes CVE

💡 Result:

The Apache Arrow 23.0.1 release, published on February 16, 2026, addresses a security vulnerability identified as CVE-2026-25087 [1][2][3]. This vulnerability is a Use After Free (UAF) issue located in the Apache Arrow C++ implementation, affecting versions 15.0.0 through 23.0.0 [2][4][5]. It can be triggered when reading an Arrow IPC file (specifically files, not IPC streams) with pre-buffering enabled, provided the file contains data with variadic buffers, such as Binary View or String View data [4][6][5]. Key technical points regarding this vulnerability include: - Trigger Mechanism: The vulnerability requires pre-buffering to be explicitly enabled via the C++ API call RecordBatchFileReader::PreBufferMetadata [2][4][5]. - Language Bindings: The Apache Arrow maintainers have stated that this functionality is not exposed in language bindings, including Python (PyArrow), Ruby, and C GLib [4][5]. Consequently, while the PyArrow package is listed in some vulnerability databases as affected (due to its dependency on the core C++ library), the Python library itself is not directly vulnerable to this exploitation [6][5][7]. - Impact: The most likely consequence is a crash or memory corruption when reading specific IPC files [4][6][5]. While exploitation for more targeted behavior, such as unauthorized data extraction, is theoretically possible, it is considered difficult and highly dependent on specific, hard-to-control memory and multi-threaded I/O patterns [4][5]. Users are advised to upgrade to Apache Arrow 23.0.1 or later to resolve the issue [4][5]. If upgrading is not immediately possible, users should either disable pre-buffering in their C++ code or ensure they are not ingesting IPC files from untrusted sources [4][5].

Citations:

Confirm the CVE fixed by the PyArrow 23.0.1 bump

Apache Arrow 23.0.1 includes the fix for CVE-2026-25087 (Use After Free in the Arrow C++ IPC implementation; affects 15.0.0–23.0.0, so 23.0.1 is the resolving upgrade). The vulnerability is tied to C++ pre-buffering and isn’t directly exposed via Python bindings, but this version bump still updates the underlying Arrow C++ library.
Update the PR/CVE description to explicitly name CVE-2026-25087 (and optionally mention the pre-buffering/C++-API trigger).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.konflux/requirements.overrides.txt at line 12, Update the PR/CVE
description to explicitly state that the pyarrow==23.0.1 upgrade addresses
CVE-2026-25087 and note that the root cause is a use-after-free in the Arrow C++
IPC implementation (pre-buffering/C++-API trigger), so although Python bindings
may not directly expose it, the underlying Arrow C++ library is patched by this
bump; reference the pyarrow==23.0.1 entry in the overrides to justify the fix.

faiss-cpu==1.12.0
sqlalchemy==2.0.45
setuptools==80.9
Expand Down
Loading