cve

1. November 9, 202620 min read

   Lakehouse Dependency CVE Ledger, November 2026: Arrow 26.0.1, Parquet Java 1.18.2 and What to Patch First

   Arrow 26.0.1 fixes a critical bundled Brotli CVE in PyArrow wheels, and Parquet Java 1.18.2 bumps its shaded Jackson. What to patch first.

2. September 21, 202631 min read

   CVE-2026-73334 and the Trust Boundary Inside an Encrypted Parquet File

   CVE-2026-73334 lets a tampered Parquet footer route a reader's KMS token to an attacker. Here's the fix, Iceberg's safe path, and how to audit your lakehouse.

Browse all posts