Skip to content

← Public intelligence

crates.io package

arrow

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    FixedSizeBinaryArray does not perform bound checks on accessing values and offsets

    GHSA-qgrp-8f3v-q85p

    Affected
    • crates.io arrow < 6.4.0
    Fixed in
    6.4.0· Vendor fix available
    Issue
    FixedSizeBinaryArray performs insufficient bounds checks, which allows out-of-bounds reads in safe code.

    Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Unratedcrates.ioPublished

    DecimalArray does not perform bound checks on accessing values and offsets

    GHSA-h588-76vg-prgj

    Affected
    • crates.io arrow < 6.4.0
    Fixed in
    6.4.0· Vendor fix available
    Issue
    DecimalArray performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.

    Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. Unratedcrates.ioPublished

    BinaryArray does not perform bound checks on reading values and offsets

    GHSA-r7cj-wmwv-hfw5

    Affected
    • crates.io arrow < 6.4.0
    Fixed in
    6.4.0· Vendor fix available
    Issue
    BinaryArray performs insufficient validation on creation, which allows out-of-bounds reads in safe code.

    Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →