Upgrade Apache Thrift to 0.24.0 in Pulsar-4.0 to mitigate CVE-2026-55971, CVE-2026-48144, CVE-2026-58023, CVE-2026-58662, CVE-2026-45112, CVE-2026-43871

[adarshhm6]

Search before reporting

• I searched in the issues and found nothing similar.

Motivation

Apache Thrift dependency is reporting multiple CVEs in 4.x
https://nvd.nist.gov/vuln/detail/CVE-2026-55971
https://nvd.nist.gov/vuln/detail/CVE-2026-48144
https://nvd.nist.gov/vuln/detail/CVE-2026-58023
https://nvd.nist.gov/vuln/detail/CVE-2026-58662
https://nvd.nist.gov/vuln/detail/CVE-2026-45112
https://nvd.nist.gov/vuln/detail/CVE-2026-43871

Please check the impact and upgrade to latest version if necessary.

Solution

Upgrade Apache Thrift to 0.24.0 to fix the CVEs

Alternatives

No response

Anything else?

No response

Are you willing to submit a PR?

• I'm willing to submit a PR!

[priyankaev]

@lhotari Any plans to upgrade Apache Thrift or you see no major impact and we can continue with existing 0.23.0 version?

[lhotari]

PR to upgrade is #26438. Will be released in 4.2.5/4.0.14.