[
https://issues.apache.org/jira/browse/FLINK-40599?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dian Fu closed FLINK-40599.
---------------------------
Fix Version/s: 2.4.0
Resolution: Fixed
Merged to master via 0bc5d308ba80aecac618701d28f3d69aa2c1ec29
> Allow pyarrow 21-25 (CVE-2026-25087)
> ------------------------------------
>
> Key: FLINK-40599
> URL: https://issues.apache.org/jira/browse/FLINK-40599
> Project: Flink
> Issue Type: Improvement
> Components: API / Python
> Reporter: Florian Vazelle
> Assignee: Florian Vazelle
> Priority: Minor
> Labels: pull-request-available
> Fix For: 2.4.0
>
>
> PyFlink currently caps pyarrow at <21.0.0. That blocks installing pyarrow
> 21–25, including versions that ship Arrow C++ 23.0.1+ (the fix for
> CVE-2026-25087).
> CVE-2026-25087 is a use-after-free in Apache Arrow C++ 15.0.0 through 23.0.0
> when reading an Arrow IPC file (not an IPC stream) with pre-buffering
> enabled. It is fixed in Arrow 23.0.1. See
> https://nvd.nist.gov/vuln/detail/CVE-2026-25087
> Raise the constraint from pyarrow>=5.0.0,<21.0.0 to pyarrow>=5.0.0,<26.0.0 in
> setup.py and pyproject.toml so Python 3.10+ can install pyarrow 25.x (Arrow
> C++ 25, which includes the fix). This does not raise the lower bound;
> installs may still resolve an older pyarrow. Apache notes that
> PreBufferMetadata is not exposed in the Python bindings, and PyFlink’s own
> Arrow path uses IPC streams.
> Python 3.9 stays supported. pyarrow 22 dropped 3.9 wheels, so pip on 3.9 will
> keep resolving a 21.x wheel inside the new range. Python 3.10+ can install
> 25.x.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
