From 12f49b8dedcc9116574f0573e6125778b037cccb Mon Sep 17 00:00:00 2001 From: Adam Reeve Date: Tue, 20 Oct 2026 22:32:46 +1300 Subject: [PATCH] Document CVE-2026-92287 in release notes Added a security notice regarding CVE-2026-92287, related to KMS URLs being read from embedded metadata in Parquet files. --- _posts/2026-10-08-26.0.0-release.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/_posts/2026-10-08-26.0.0-release.md b/_posts/2026-10-08-26.0.0-release.md index 8d1ea38a79a..598756cc105 100644 --- a/_posts/2026-10-08-26.0.0-release.md +++ b/_posts/2026-10-08-26.0.0-release.md @@ -93,6 +93,12 @@ using `LoadFileSystemFactories`. ### Parquet +#### CVE-2026-92287: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation + +A security issue was fixed where KMS URLs embedded in Parquet files were forwarded to a user-implemented KMS client. This is now disabled by default but can be optionally enabled, in which case users should ensure they validate the KMS URLs received ([GH-51349](https://github.com/apache/arrow/issues/51349)). + +See our [separate announcement](https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57) for further detail. + The schema nesting depth is now limited when parsing the Thrift metadata of a Parquet file, turning a stack overflow on pathologically nested schemas into a regular error ([GH-51238](https://github.com/apache/arrow/issues/51238)). The default limit (100) can be raised if needed.