diff --git a/_posts/2026-02-16-23.0.1-release.md b/_posts/2026-02-16-23.0.1-release.md new file mode 100644 index 00000000000..059190fceeb --- /dev/null +++ b/_posts/2026-02-16-23.0.1-release.md @@ -0,0 +1,98 @@ +--- +layout: post +title: "Apache Arrow 23.0.1 Release" +date: "2026-02-16 00:00:00" +author: pmc +categories: [release] +--- + + + +The Apache Arrow team is pleased to announce the 23.0.1 release. +It includes **a security fix for the C++ IPC file reader**, so be sure to +read the relevant details below to see if you are affected. + +Apart from that, 23.0.1 is mostly a bugfix release that includes [**28 resolved issues**][1] +on [**29 distinct commits**][2] from [**12 distinct contributors**][2]. + +See the [Install Page](https://arrow.apache.org/install/) to +learn how to get the libraries for your platform. + +The release notes below are not exhaustive and only expose selected highlights +of the release. Many other bugfixes and improvements have been made: we refer +you to the [complete changelog][3]. + +## C++ notes + +* Fix possible OOB write in buffered IO ([GH-48311](https://github.com/apache/arrow/issues/48311)). + +### IPC + +#### CVE-2026-25087: Use After Free vulnerability in IPC file reader + +Fix a security issue can be triggered when reading an Arrow IPC file (but *not* +an IPC stream) with pre-buffering enabled, if the IPC file contains data with +variadic buffers (such as Binary View and String View data). + +Pre-buffering is disabled by default, so your code is vulnerable only if it +enables it explicitly by calling `RecordBatchFileReader::PreBufferMetadata`. +Affected Arrow C++ versions are 15.0.0 through 23.0.0. The fix integrated +in 23.0.1 can also be separately viewed at +[GH-48925](https://github.com/apache/arrow/pull/48925). + +See our [separate announcement](https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh) +for further detail. + +#### Other fixes + +* Avoid memory blowup with excessive variadic buffer count in IPC ([GH-48900](https://github.com/apache/arrow/issues/48900)). + +### Gandiva + +* Fix passing CPU attributes to LLVM ([GH-48160](https://github.com/apache/arrow/issues/48160)). +* Detect overflow in `repeat()` ([GH-49159](https://github.com/apache/arrow/issues/49159)). + +### Parquet + +* Avoid re-serializing footer for signature verification ([GH-48858](https://github.com/apache/arrow/issues/48858)). + +## Python notes + +* Added missing NOTICE.txt and LICENSE.txt to wheels ([GH-48983](https://github.com/apache/arrow/issues/48983)). +* Some fixes for compatibility with newer Cython versions like ([GH-48965](https://github.com/apache/arrow/issues/48965)), + ([GH-49156](https://github.com/apache/arrow/issues/49156)) and ([GH-49138](https://github.com/apache/arrow/issues/49138)). + +## Ruby notes + +* Fix a bug where ``Arrow::ExecutePlan`` nodes may be Garbage Collected ([GH-48880](https://github.com/apache/arrow/issues/48880)). + +## R notes + +* Bump C++20 for R build infrastructure ([GH-48817](https://github.com/apache/arrow/issues/48817)) + and fix some C++ 20 related compilation issues ([GH-48973](https://github.com/apache/arrow/issues/48973)). + +## Other modules and languages + +No general changes were made to the other libraries or languages. + + +[1]: https://github.com/apache/arrow/milestone/73?closed=1 +[2]: {{ site.baseurl }}/release/23.0.1.html#contributors +[3]: {{ site.baseurl }}/release/23.0.1.html#changelog