PyPI/ray CVE-2026-41486: high 8.8, EPSS 0.70%
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_sha
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.54.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-2272
- https://github.com/ray-project/ray/releases/tag/ray-2.55.0
- https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r
- https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f
- https://github.com/ray-project/ray/pull/62056
CVE-2026-41486 · published · modified · JSON