Apache Arrow 26.0.1 Release

Published 03 Nov 2026
By The Apache Arrow PMC (pmc)

The Apache Arrow team is pleased to announce the 26.0.1 release. The 26.0.1 release is mostly a security bugfix release that includes 20 resolved issues on 24 distinct commits from 14 distinct contributors.

See the Install Page to learn how to get the libraries for your platform.

The release notes below are not exhaustive and only expose selected highlights of the release. Many other bugfixes and improvements have been made: we refer you to the complete changelog.

This release includes a security fix where we have bumped the bundled version for Brotli which was affected by CVE-2026-111497. The Brotli CVE affected PyArrow wheels and R binaries.

C++ notes

  • Fix parquet treating unknown compression codec as uncompressed (GH-53518).
  • Fix possibly reading out of bounds a MapArray on invalid IPC stream/file (GH-54936).
  • Fix out of bounds read in round(int, precision) for the most negative precision on Gandiva (GH-50544).
  • Fix Content Defined Chunking resetting its state on every row group (GH-51684).

Python notes

  • Bump Brotli version on PyArrow (GH-55165) to avoid bundling version with CVE-2026-111497.
  • Fix pyarrow.compute.indices_nonzero segfaulting on a ChunkedArray with zero chunks (GH-51018).

R notes

Linux packaging notes

  • Add missing opentelemetry dependency to libarrow2600 on Debian packages (GH-55112).

Other modules and languages

No general changes were made to the other libraries or languages.