Missing initialization of resource in Apache Arrow
Priority LOW 39CWE-909Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Why it matters now
EPSS 0.03225 88th percentileScored 2026-11-07
Fix Fixed pyarrow (PyPI): 0.15.1red-arrow (RubyGems): 0.15.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Arrow | Apache Arrow 0.14.0 to 0.14.1 | — | No fix listed | CNA |
| — | pyarrow (PyPI) | 0.14.0 to before 0.15.1 | 0.15.1 | Patch available | GHSA-8cw2-jv5c-c825 |
| — | red-arrow (RubyGems) | 0.14.0 to before 0.15.1 | 0.15.1 | Patch available | GHSA-8cw2-jv5c-c825 |
- Apache Arrow VendorApache Affected Apache Arrow 0.14.0 to 0.14.1 Fixed in — No fix listed CNA
- pyarrow (PyPI) Vendor— Affected 0.14.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-8cw2-jv5c-c825
- red-arrow (RubyGems) Vendor— Affected 0.14.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-8cw2-jv5c-c825
Remediation
- Fix · GHSA-8cw2-jv5c-c825 pyarrow (PyPI) Fixed in 0.15.1 Advisory →
- Fix · GHSA-8cw2-jv5c-c825 red-arrow (RubyGems) Fixed in 0.15.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12408
- 2026-10-03 Alias added: GHSA-8cw2-jv5c-c825
References
Other 6
- https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E
- [announce] 20191108 [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1
- https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2019-195.yaml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/red-arrow/CVE-2019-12408.yml
- https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
- https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
More Apache Arrow vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2024-35010 Apache Arrow R package: Arbitrary code execution when loading a malicious data file CVSS 3.1CRITICAL 9.8
- TI-2024-27524 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files CVSS 3.1HIGH 7.5
- TI-2019-09256 Missing initialization of resource in Apache Arrow CVSS 3.1HIGH 7.5
- TI-2026-20262 Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering CVSS 3.1HIGH 7.0
Sources
- CVE-2019-12408 · CVE Program
- CVE-2019-12408 · NVD
- FIRST EPSS
- GHSA-8cw2-jv5c-c825 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences