CVE-2026-111959

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111959", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-17T16:33:55.330Z", "datePublished": "2026-11-02T13:34:17.835Z", "dateUpdated": "2026-11-06T18:35:40.676Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-02T13:34:17.835Z"}, "title": "Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads", "problemTypes": [{"descriptions": [{"description": "CWE-125 Out-of-bounds read", "lang": "en", "cweId": "CWE-125", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-20 Improper input validation", "lang": "en", "cweId": "CWE-20", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Arrow Rust", "packageURL": "pkg:cargo/arrow", "versions": [{"status": "affected", "version": "60.0.0", "lessThan": "60.1.0", "versionType": "semver"}, {"status": "affected", "version": "59.0.0", "lessThanOrEqual": "59.3.1", "versionType": "semver"}, {"status": "affected", "version": "58.0.0", "lessThanOrEqual": "58.4.0", "versionType": "semver"}, {"status": "affected", "version": "33.0.0", "lessThanOrEqual": "57.3.1", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://crates.io", "packageName": "arrow"}], "descriptions": [{"value": "Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.</p><p>Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.</p><p>Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Adam Korczynski of Ada Logics", "type": "reporter"}, {"lang": "en", "value": "Anthropic", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/02/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-02T20:05:09.522Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T18:35:18.470735Z", "id": "CVE-2026-111959", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:35:40.676Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/02/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-02T20:05:09.522Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-111959", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T18:35:18.470735Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:35:36.994Z"}}], "cna": {"title": "Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Adam Korczynski of Ada Logics"}, {"lang": "en", "type": "finder", "value": "Anthropic"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Arrow Rust", "versions": [{"status": "affected", "version": "60.0.0", "lessThan": "60.1.0", "versionType": "semver"}, {"status": "affected", "version": "59.0.0", "versionType": "semver", "lessThanOrEqual": "59.3.1"}, {"status": "affected", "version": "58.0.0", "versionType": "semver", "lessThanOrEqual": "58.4.0"}, {"status": "affected", "version": "33.0.0", "versionType": "semver", "lessThanOrEqual": "57.3.1"}], "packageURL": "pkg:cargo/arrow", "packageName": "arrow", "collectionURL": "https://crates.io", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.</p><p>Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.</p><p>Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-02T13:34:17.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111959", "state": "PUBLISHED", "dateUpdated": "2026-11-06T18:35:40.676Z", "dateReserved": "2026-10-17T16:33:55.330Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-11-02T13:34:17.835Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://crates.io", "defaultStatus": "unaffected", "packageName": "arrow", "packageURL": "pkg:cargo/arrow", "product": "Apache Arrow Rust", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "60.1.0", "status": "affected", "version": "60.0.0", "versionType": "semver"}, {"lessThanOrEqual": "59.3.1", "status": "affected", "version": "59.0.0", "versionType": "semver"}, {"lessThanOrEqual": "58.4.0", "status": "affected", "version": "58.0.0", "versionType": "semver"}, {"lessThanOrEqual": "57.3.1", "status": "affected", "version": "33.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue."}], "id": "CVE-2026-111959", "lastModified": "2026-11-06T19:17:33.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111959", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T18:35:18.470735Z", "version": "2.0.3"}}]}, "published": "2026-11-02T14:17:35.493", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/02/2"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-125"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "arrow: arrow: Out-of-bounds read via improper validation of RunEndEncoded arrays", "id": "2565187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565187"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in arrow. Improper validation of RunEndEncoded (run-end encoded) arrays in the ArrayData interface allows an attacker to read data beyond the bounds of the child values array by supplying specially crafted data. This out-of-bounds read flaw may lead to information disclosure or a denial of service (DoS) from an application crash."], "name": "CVE-2026-111959", "package_state": [{"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Out of support scope", "package_name": "openshift-logging/vector-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}], "public_date": "2026-11-02T13:34:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111959\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111959\nhttps://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[60.0.0,60.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[59.0.0,59.3.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[58.0.0,58.4.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[33.0.0,57.3.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Arrow Rust", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "arrow_rust", "vendor": "apache"}], "created": "2026-11-02T14:30:11.772857+00:00", "updated": "2026-11-06T20:30:10.493912+00:00", "vendors": ["apache", "apache$PRODUCT$arrow_rust"]}