RUSTSEC-2022-0012: Arrow2 allows double free in `safe` code

What to do

1. See which version you have: cargo tree -i arrow2 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p arrow2. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example arrow2 = "0.9.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The struct Ffi_ArrowArray implements #derive(Clone) that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned.

Cloning this struct in safe results in a segmentation fault, which is unsound.

This derive was removed from this struct. All users are advised to either:

• bump the patch version of this crate (for versions v0.7,v0.8,v0.9), or
• migrate to a more recent version of the crate (when using <0.7).

Doing so elimitates this vulnerability (code no longer compiles).

References

• Package: crates.io/crates/arrow2
• Advisory: rustsec.org/advisories/RUSTSEC-2022-0012.html
• Report: github.com/jorgecarleitao/arrow2/issues/880

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for arrow2

• VulnerabilityRUSTSEC-2025-0038 · 2025-04-24Out of bounds access in public safe API

Full security history of arrow2