Florian Vazelle created FLINK-40599:
---------------------------------------
Summary: Allow pyarrow 21-25 (CVE-2026-25087)
Key: FLINK-40599
URL: https://issues.apache.org/jira/browse/FLINK-40599
Project: Flink
Issue Type: Improvement
Components: API / Python
Reporter: Florian Vazelle
PyFlink currently caps pyarrow at <21.0.0. That blocks installing pyarrow
21–25, including versions that ship Arrow C++ 23.0.1+ (the fix for
CVE-2026-25087).
CVE-2026-25087 is a use-after-free in Apache Arrow C++ 15.0.0 through 23.0.0
when reading an Arrow IPC file (not an IPC stream) with pre-buffering enabled.
It is fixed in Arrow 23.0.1. See https://nvd.nist.gov/vuln/detail/CVE-2026-25087
Raise the constraint from pyarrow>=5.0.0,<21.0.0 to pyarrow>=5.0.0,<26.0.0 in
setup.py and pyproject.toml so Python 3.10+ can install pyarrow 25.x (Arrow C++
25, which includes the fix). This does not raise the lower bound; installs may
still resolve an older pyarrow. Apache notes that PreBufferMetadata is not
exposed in the Python bindings, and PyFlink’s own Arrow path uses IPC streams.
Python 3.9 stays supported. pyarrow 22 dropped 3.9 wheels, so pip on 3.9 will
keep resolving a 21.x wheel inside the new range. Python 3.10+ can install 25.x.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
