You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "adarshhm6 (via GitHub)" <gi...@apache.org> on 2026/08/10 06:43:01 UTC
[I] Upgrade Apache Thrift to 0.24.0 in Pulsar-4.0 to mitigate CVE-2026-55971, CVE-2026-48144, CVE-2026-58023, CVE-2026-58662 [pulsar]
adarshhm6 opened a new issue, #26297:
URL: https://github.com/apache/pulsar/issues/26297
### Search before reporting
- [x] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Motivation
Apache Thrift dependency is reporting multiple CVEs
https://nvd.nist.gov/vuln/detail/CVE-2026-55971
https://nvd.nist.gov/vuln/detail/CVE-2026-48144
https://nvd.nist.gov/vuln/detail/CVE-2026-58023
https://nvd.nist.gov/vuln/detail/CVE-2026-58662
Please check the impact and upgrade to latest version if necessary.
### Solution
Upgrade Apache Thrift to 0.24.0 to fix the CVEs
### Alternatives
_No response_
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrade Apache Thrift to 0.24.0 in Pulsar-4.0 to mitigate CVE-2026-55971, CVE-2026-48144, CVE-2026-58023, CVE-2026-58662, CVE-2026-45112, CVE-2026-43871 [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on issue #26297:
URL: https://github.com/apache/pulsar/issues/26297#issuecomment-5476103997
PR to upgrade is #26438. Will be released in 4.2.5/4.0.14.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Upgrade Apache Thrift to 0.24.0 in Pulsar-4.0 to mitigate CVE-2026-55971, CVE-2026-48144, CVE-2026-58023, CVE-2026-58662 [pulsar]
Posted by "priyankaev (via GitHub)" <gi...@apache.org>.
priyankaev commented on issue #26297:
URL: https://github.com/apache/pulsar/issues/26297#issuecomment-5263264018
@lhotari Any plans to upgrade Apache Thrift or you see no major impact and we can continue with existing 0.23.0 version?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org