{"action":"Upgrade pyarrow to 0.15.0 or later.","affected":[{"fixed":"0.15.0","introduced":"0.14.0"}],"component":"pyarrow","cve_ids":["CVE-2019-12408"],"ecosystem":"PyPI","epss":0.03225,"exploited":false,"fixed_versions":["0.15.0"],"ghsa_id":"GHSA-8cw2-jv5c-c825","id":"tcs_01M5KG8WWA3J5X04RR4ZZWPY6J","modified_at":"2026-06-10T17:01:39.667400278Z","published_at":"2019-11-08T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-195","https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E","https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E","https://github.com/advisories/GHSA-8cw2-jv5c-c825"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2019-195","url":"https://osv.dev/vulnerability/PYSEC-2019-195"},{"source":"nvd","source_id":"CVE-2019-12408","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12408"}],"summary":"It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null va"}