CVE-2026-92287

Name of the Vulnerable Software and Affected Versions Apache C++ Parquet versions 4.0.0 through 25.0.1 PyArrow versions 4.0.0 through 25.0.1

Description Unvalidated KMS URLs are passed to KMS clients when reading Parquet files configured with a KmsClient implementation. The KMS URL can be application-controlled via KmsConnectionConfig or file-controlled. When application control is not used, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the implementation fails to perform host validation, a KMS token may be sent to a malicious host specified by an attacker within the file.

Recommendations Upgrade to version 26.0.0. Specify the KMS URL in the KmsConnectionConfig when reading files. Ensure that KmsClient implementations validate received KMS URLs.