Describe the enhancement requested
CVE-2026-55969 affects Apache Thrift versions before 0.24.0. It is an integer overflow in TProtocol::checkReadBytesAvailable() (CWE-190), and Apache Thrift 0.24.0 is reported as the fixed version:
The current main branch appears to pin the bundled Thrift dependency to 0.22.0 in cpp/thirdparty/versions.txt. Arrow C++ Parquet uses Thrift's compact protocol and memory buffer to deserialize Parquet metadata, so this dependency is relevant to the C++/Parquet build.
Could we update the bundled Apache Thrift dependency to 0.24.0 or later?
Component(s)
C++, Parquet
Describe the enhancement requested
CVE-2026-55969 affects Apache Thrift versions before 0.24.0. It is an integer overflow in
TProtocol::checkReadBytesAvailable()(CWE-190), and Apache Thrift 0.24.0 is reported as the fixed version:The current
mainbranch appears to pin the bundled Thrift dependency to 0.22.0 incpp/thirdparty/versions.txt. Arrow C++ Parquet uses Thrift's compact protocol and memory buffer to deserialize Parquet metadata, so this dependency is relevant to the C++/Parquet build.Could we update the bundled Apache Thrift dependency to 0.24.0 or later?
Component(s)
C++, Parquet