CVE-2026-41486
3 advisories.
PyPI/ray CVE-2026-41486: high, EPSS 0.70%
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Action: Upgrade ray to 2.55.0 or later.
pip install ray==2.55.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.49.0 | 2.55.0 | - |
Fixed versions
| 2.55.0 |
Sources
- osv: GHSA-mw35-8rx3-xf9r
- https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r
- https://nvd.nist.gov/vuln/detail/CVE-2026-41486
- https://github.com/ray-project/ray/pull/54831
- https://github.com/ray-project/ray/pull/62056
- https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f
- https://github.com/ray-project/ray
- https://github.com/ray-project/ray/releases/tag/ray-2.55.0
CVE-2026-41486 · published · modified · JSON
PyPI/ray CVE-2026-41486: high 8.8, EPSS 0.70%
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_sha
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.54.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-2272
- https://github.com/ray-project/ray/releases/tag/ray-2.55.0
- https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r
- https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f
- https://github.com/ray-project/ray/pull/62056
CVE-2026-41486 · published · modified · JSON
PyPI/ve-ray CVE-2026-41486: high 8.8, EPSS 0.70%
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_sha
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.54.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-2296
- https://github.com/ray-project/ray/releases/tag/ray-2.55.0
- https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r
- https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f
- https://github.com/ray-project/ray/pull/62056
CVE-2026-41486 · published · modified · JSON