[C++][Parquet] Update bundled Apache Thrift to 0.24.0 for CVE-2026-55969 #51354

Describe the enhancement requested

CVE-2026-55969 affects Apache Thrift versions before 0.24.0. It is an integer overflow in TProtocol::checkReadBytesAvailable() (CWE-190), and Apache Thrift 0.24.0 is reported as the fixed version:

• https://osv.dev/vulnerability/CVE-2026-55969

The current main branch appears to pin the bundled Thrift dependency to 0.22.0 in cpp/thirdparty/versions.txt. Arrow C++ Parquet uses Thrift's compact protocol and memory buffer to deserialize Parquet metadata, so this dependency is relevant to the C++/Parquet build.

Could we update the bundled Apache Thrift dependency to 0.24.0 or later?

Component(s)

C++, Parquet