Threats affecting pkg:pypi/pyarrow

CVE-2026-92287 is an improper input validation vulnerability in Apache Arrow C++ (Parquet and PyArrow) versions 4.0.0 up to but not including 26.0.0. The flaw involves passing unvalidated KMS URLs to KMS clients, which can be controlled by an attacker via file contents. This may lead to sensitive KMS tokens being sent to malicious hosts. Version 26.0.0 addresses this by disabling file-controlled KMS URLs by default and requiring explicit opt-in with validation.