{"action":"Upgrade ray to 2.55.0 or later.","affected":[{"fixed":"2.55.0","introduced":"2.49.0"}],"component":"ray","cve_ids":["CVE-2026-41486"],"ecosystem":"PyPI","epss":0.00473,"exploited":false,"fixed_versions":["2.55.0"],"ghsa_id":"GHSA-mw35-8rx3-xf9r","id":"tcs_01M5KFRTKYBYQKXSJ4C19RQFB8","modified_at":"2026-09-10T03:51:02.380215690Z","published_at":"2026-04-24T16:15:00Z","references":["https://osv.dev/vulnerability/GHSA-mw35-8rx3-xf9r","https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r","https://nvd.nist.gov/vuln/detail/CVE-2026-41486","https://github.com/ray-project/ray/pull/54831","https://github.com/ray-project/ray/pull/62056","https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f","https://github.com/ray-project/ray","https://github.com/ray-project/ray/releases/tag/ray-2.55.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-mw35-8rx3-xf9r","url":"https://osv.dev/vulnerability/GHSA-mw35-8rx3-xf9r"},{"source":"nvd","source_id":"CVE-2026-41486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41486"}],"summary":"Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization"}