iida7 opened a new issue, #51354: URL: https://github.com/apache/arrow/issues/51354
### Describe the enhancement requested ### Describe the enhancement requested CVE-2026-55969 affects Apache Thrift versions before 0.24.0. It is an integer overflow in `TProtocol::checkReadBytesAvailable()` (CWE-190), and Apache Thrift 0.24.0 is reported as the fixed version: - https://osv.dev/vulnerability/CVE-2026-55969 The current `main` branch appears to pin the bundled Thrift dependency to 0.22.0 in `cpp/thirdparty/versions.txt`. Arrow C++ Parquet uses Thrift's compact protocol and memory buffer to deserialize Parquet metadata, so this dependency is relevant to the C++/Parquet build. Could we update the bundled Apache Thrift dependency to 0.24.0 or later? ### Component(s) C++, Parquet -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
