rdblue opened a new issue, #16457: URL: https://github.com/apache/iceberg/issues/16457
> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution. > > Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them. # Summary Arrow readers use effectively unlimited allocators and never close scan child allocators, making direct-memory exhaustion and long-lived allocator buildup easy to trigger. # Affected Maven coordinates * primary shipped client artifact: `org.apache.iceberg:iceberg-arrow` # Attacker prerequisites * ability to make the target process parse attacker-controlled or semi-trusted table data or metadata * enough repetition or input size to trigger the unchecked allocation or crash path # Impact * A service that scans attacker-controlled or multi-tenant Parquet data can be forced into direct-memory exhaustion. * Because the root allocator is global, the blast radius is process-wide rather than scan-local. * Repeated scans also accumulate unclosed child allocators, which is a long-lived resource-management problem even when buffers are eventually released. # Proof status Source review only. The issue is visible directly from source. # Key source references * org.apache.iceberg.arrow.ArrowAllocation * org.apache.iceberg.arrow.vectorized.VectorizedReaderBuilder * org.apache.iceberg.arrow.vectorized.VectorizedArrowReader Current severity assessment [2]: Important [1] https://iceberg.apache.org/security/ [2] https://security.apache.org/blog/severityrating/ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
