paolosartiprom opened a new issue, #55390: URL: https://github.com/apache/arrow/issues/55390
### Describe the bug, including details regarding any error messages, version, and platform. ## Summary PyArrow 26.0.1 fixes CVE-2026-111497 (critical Brotli OOB-write, CVSS 9.2, in CISA KEV) via [GH-55165 / PR #55167](https://github.com/apache/arrow/pull/55167) — a single vendored Brotli bump to 1.2.1. PyArrow 26.0.0 simultaneously dropped NumPy 1.x support ([GH-48473](https://github.com/apache/arrow/issues/48473)), making the 26.x line incompatible with large legacy NumPy 1 codebases that cannot migrate in the short term. This leaves 25.x users in a dead-end: upgrade to 26.x and break NumPy 1 compatibility, or stay on 25.x and remain exposed to an actively-exploited critical CVE. ## Request Please release a new **25.0.x** by cherry-picking only PR #55167. The fix is a self-contained vendored C library bump — no functional PyArrow changes required. ## References - CVE: CVE-2026-111497 / [GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35) - Fix in 26.0.1: [apache/arrow#55167](https://github.com/apache/arrow/pull/55167) - NumPy 1 dropped: [GH-48473](https://github.com/apache/arrow/issues/48473) ### Component(s) Python -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
