From 556d262cdf01d1b3df1723ec8def6120280d142a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 30 May 2025 20:11:59 +0000
Subject: [PATCH] Publish GHSA-wv8j-m3hx-924j

---
 .../GHSA-wv8j-m3hx-924j.json                  | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/05/GHSA-wv8j-m3hx-924j/GHSA-wv8j-m3hx-924j.json

diff --git a/advisories/github-reviewed/2025/05/GHSA-wv8j-m3hx-924j/GHSA-wv8j-m3hx-924j.json b/advisories/github-reviewed/2025/05/GHSA-wv8j-m3hx-924j/GHSA-wv8j-m3hx-924j.json
new file mode 100644
index 00000000000..e5d7647024f
--- /dev/null
+++ b/advisories/github-reviewed/2025/05/GHSA-wv8j-m3hx-924j/GHSA-wv8j-m3hx-924j.json
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wv8j-m3hx-924j",
+  "modified": "2025-05-30T20:09:56Z",
+  "published": "2025-05-30T20:09:56Z",
+  "aliases": [],
+  "summary": "Arrow2 allows out of bounds access in public safe API",
+  "details": "`Rows::row_unchecked()` allows out of bounds access to the underlying buffer without sufficient checks.\n\nThe arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "arrow2"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.18.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jorgecarleitao/arrow2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0038.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-30T20:09:56Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file