Vulnerability HighRUSTSEC-2025-0038 · arrow2
RUSTSEC-2025-0038: Out of bounds access in public safe API
Short answerA security vulnerability in the arrow2 crate: Out of bounds access in public safe API. GitHub rates it High. No fixed version: replace the crate or remove the affected code path.
| Crate | arrow2 |
|---|---|
| Type | Vulnerability (memory-exposure) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High (GitHub rating) |
| Published | 2025-04-24 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-wv8j-m3hx-924j |
What to do
- Find who pulls it in:
cargo tree -i arrow2. - Avoid the affected API, or replace the crate.
Details from the advisory
Rows::row_unchecked() allows out of bounds access to the underlying buffer without sufficient checks.
The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.
References
- Package: crates.io/crates/arrow2
- Advisory: rustsec.org/advisories/RUSTSEC-2025-0038.html
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for arrow2
Up next
Same cratearrow2: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?