Apache Arrow 23.0.1 Release

The Apache Arrow team is pleased to announce the 23.0.1 release. It includes a security fix for the C++ IPC file reader, so be sure to read the relevant details below to see if you are affected. Apart from that, 23.0.1 is mostly a bugfix release that includes 28 resolved issues on 29 distinct commits from 12 distinct contributors. See the Install Page to learn how to get the libraries for your platform. The release notes below are not exhaustive and only expose selected highlights of the release. Many other bugfixes and improvements have been made: we refer you to the complete changelog. C++ notes Fix possible OOB write in buffered IO (GH-48311). IPC CVE-2026-25087: Use After Free vulnerability in IPC file reader Fix a security issue can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Pre-buffering is disabled by default, so your code is vulnerable only if it enables it explicitly by calling RecordBatchFileReader::PreBufferMetadata. Affected Arrow C++ versions are 15.0.0 through 23.0.0. The fix integrated in 23.0.1 can also be separately viewed at GH-48925. See our separate announcement for further detail. Other fixes Avoid memory blowup with excessive variadic buffer count in IPC (GH-48900). Gandiva Fix passing CPU attributes to LLVM (GH-48160). Detect overflow in repeat() (GH-49159). Parquet Avoid re-serializing footer for signature verification (GH-48858). Python notes Added missing NOTICE.txt and LICENSE.txt to wheels (GH-48983). Some fixes for compatibility with newer Cython versions like (GH-48965), (GH-49156) and (GH-49138). Ruby notes Fix a bug where Arrow::ExecutePlan nodes may be Garbage Collected (GH-48880). R notes Bump C++20 for R build infrastructure (GH-48817) and fix some C++ 20 related compilation issues (GH-48973). Other modules and languages No general changes were made to the other libraries or languages.