zhangkre commented on issue #1234: URL: https://github.com/apache/arrow-java/issues/1234#issuecomment-5011246494
> [@zhangkre](https://github.com/zhangkre) if you have vulnerabilities to disclose, please follow the ASF process: https://github.com/apache/arrow-java?tab=security-ov-file > > That said, we've been discussing the security policy for Arrow: https://arrow.apache.org/docs/format/Security.html > > It's not clear to me that we'd consider memory leaks as vulnerabilities, unless it can be shown that an attacker can cause excessive memory usage with a very small or trivial input. Given that the IPC format allows (de)compression, unbounded memory usage is always possible and is something that should be mitigated in other ways, e.g. bounding the allocator and tying it to a health check on a service (although we should absolutely fix cases like these where possible and document this more clearly). I appreciate the clarification. In my view: 1. This is a functional issue, not a security vulnerability - The memory leak affects functionality (e.g., resource exhaustion, service degradation) rather than exposing any security boundary. I suggest we: - Fix when possible - Continue addressing avoidable memory leaks in the code -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
