Repository navigation
fix: allow thrift 0.25.x and clear additional Apache Thrift CVEs - #975
Merged
Merged
Conversation
Widen the thrift constraint from ~=0.24.0 to >=0.24.0,<0.26.0 so 0.25.0 can be resolved. thrift 0.25.0 fixes 61 CVEs across language bindings, several affecting the Python binding this connector uses, including CVE-2026-66858 (skip() recursion-limit bypass in the Python accelerator) and CVE-2026-85494 (framed transport / binary protocol size a read buffer from a peer-declared length with no effective maximum). thrift 0.25.0 also changes TBinaryProtocol's default string_length_limit from unbounded (None) to ~15.6 MiB (DEFAULT_MAX_FRAME_SIZE) as part of that same CVE-2026-85494 fix. This connector already bounds its own result stream via the TLS-verified, server-negotiated buffer_size_bytes (default 100 MiB), and inline Arrow result batches in TFetchResultsResp routinely exceed thrift's new ~15.6 MiB cap, so a bare version bump would regress large-result-set reads. Construct TBinaryProtocol with explicit string_length_limit=None and container_length_limit=None to preserve pre-0.25 unbounded behavior for the connector's own already-bounded, trusted-server result stream. 0.25.0 ships the same prebuilt wheel matrix as 0.24.0 (manylinux2014/macOS/musl/Windows, cp310-cp314), so the DBR LTS build-time packaging risk that originally capped this dependency (#798, #840) does not apply; the DBR LTS Install CI gate remains the authoritative check. Closes #969 Signed-off-by: Paddy Hannon <pih@ehukai.com> AOS-Session: 01a10c87-3242-7517-a60e-279091b796c3 AOS-Session: pi-1791211537-21291-e08bda26 AOS-Commit-Time: 2026-10-05T15:03:26Z Signed-off-by: Vu Anh Phung <vu.phung@databricks.com>
vuanhphung
had a problem deploying
to
azure-prod
October 8, 2026 00:26 — with 
GitHub Actions
Failure
GitHub Actions
Failure
![peco-review-bot[bot]](https://avatars.githubusercontent.com/in/3801177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: 1 Low
Looks good — a clean, well-documented thrift 0.24→0.25 bump (CVE remediation) plus an explicit string_length_limit=None/container_length_limit=None passthrough to preserve pre-0.25 unbounded-read behavior, with matching unit coverage. The only occurrence of the affected TBinaryProtocol construction in the library path is the one changed, and the new kwargs are valid on both ends of the version constraint. One low-severity note on preferring a finite cap over fully unbounded as defense-in-depth.
vuanhphung
added
integration-test
|
Integration tests triggered. View workflow runs. Result posts back here as the "Python Integration Tests" check. |
1 similar comment
|
Integration tests triggered. View workflow runs. Result posts back here as the "Python Integration Tests" check. |
vikrantpuppala
approved these changes
Oct 8, 2026
vuanhphung
enabled auto-merge
October 8, 2026 06:56
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Internal copy of #970 by @hannonpi1228 so CI checks that need repository secrets (notably
DBR LTS Install) can run. The contributor's commit is preserved and rebased onmain; only thepoetry.lockcontent-hash conflicted and was recomputed.Closes #969.
Summary
Widens
thriftto>=0.24.0,<0.26.0and locks 0.25.0, which fixes several CVEs affecting the Python binding (including CVE-2026-85494 and CVE-2026-66858). 0.25.0 also changesTBinaryProtocol's defaultstring_length_limitfrom unbounded to 16,384,000 bytes per field, so the connector now passesstring_length_limit=Noneexplicitly to keep large inline results (e.g. Arrow batches) readable as before.Review notes
string_length_limit=Nonepreserves pre-0.25 behavior but opts the connector's Thrift path out of the new default bound. A large finite cap is the alternative.THttpClient,TSocketandTSerializationare unchanged between thrift 0.24.0 and 0.25.0, and 0.25.0 ships the same wheel matrix (plus Windows ARM64), so the DBR LTS sdist-build failure that motivated the original pin shouldn't recur.DBR LTS Installis the gate.poetry lockagainst JFrog; confirm the logs show thrift 0.25.0 installed rather than a fallback to 0.24.0.Testing
This pull request and its description were written by Isaac.
This PR was created with GitHub MCP.