GitHub Advisoryadvisory · crates.io

GHSA-wv8j-m3hx-924j Arrow2 allows out of bounds access in public safe API

HIGH Published 2025-05-30 Modified 2025-05-30 Official page ↗
Ecosystem
crates.io
Packages
arrow2
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-119
Reviewed
2025-05-30

Affected packages

• crates.io arrow2: <= 0.18.0 (no fix yet)

Description

`Rows::row_unchecked()` allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References