GH-51354: [C++][Parquet] Update bundled Apache Thrift to 0.24.0

[Hanayoshi-8744]

Rationale for this change

The bundled Apache Thrift dependency (0.22.0) is affected by
CVE-2026-55969, an integer overflow vulnerability in
TTransport::checkReadBytesAvailable() that could bypass message
size checks when reading maliciously crafted Thrift-encoded data.
Arrow's Parquet module relies on Thrift's compact protocol to
deserialize Parquet file metadata, so this is relevant to Arrow.

What changes are included in this PR?

• Bump the bundled Apache Thrift version from 0.22.0 to 0.24.0 in
  cpp/thirdparty/versions.txt (including the SHA256 checksum).
• Remove the Clang-only thrift-3187.patch and its application logic
  in ThirdpartyToolchain.cmake. This patch pre-applied Thrift's
  upstream fix for THRIFT-3268 (a compiler warning), which has since
  been merged into Thrift itself and is already included in 0.24.0.
  Keeping the patch would make git apply/patch fail during the
  bundled build with Clang.

Are these changes tested?

• Verified that thrift-0.24.0.tar.gz downloads correctly and its
  SHA256 checksum matches the value published at
  downloads.apache.org.
• Confirmed the CVE fix is present in Thrift 0.24.0 by diffing
  TProtocol.h, TCompactProtocol.h, TBinaryProtocol.h, and
  TTransport.h against 0.22.0.
• Confirmed thrift-3187.patch no longer applies cleanly against
  0.24.0 sources (already fixed upstream), which is why it was
  removed rather than kept as a no-op.
• Built Arrow C++ locally on macOS (arm64, AppleClang) with
  -DARROW_PARQUET=ON -DARROW_BUILD_TESTS=ON -DThrift_SOURCE=BUNDLED,
  on top of the latest main (after rebasing), and ran the following
  Parquet tests. All of them passed with no failures (some tests were
  skipped, e.g. those requiring Snappy, which was not enabled in my
  build):
  parquet-internals-test, parquet-file-deserialize-test,
  parquet-schema-test, parquet-reader-test,
  parquet-writer-test, parquet-arrow-reader-writer-test,
  parquet-arrow-metadata-test, parquet-arrow-index-test, and
  parquet-arrow-internals-test.
• Not tested locally: the removed patch was only applied for
  CMAKE_CXX_COMPILER_ID STREQUAL "Clang", which my AppleClang build
  does not hit, so building the bundled Thrift with Clang on Linux
  relies on CI. I also did not test encryption, Windows/MSVC, or the
  Python/R packaging builds locally.

Are there any user-facing changes?

No.

• GitHub Issue: [C++][Parquet] Update bundled Apache Thrift to 0.24.0 for CVE-2026-55969 #51354

---

Disclosure: this change was prepared with the assistance of an AI
coding tool (Claude Code). I reviewed the diff, verified the CVE fix
and checksum myself, and ran the test suite locally before opening
this PR.

🤖 Generated with Claude Code

[github-actions]

⚠️ GitHub issue #51354 has been automatically assigned in GitHub to PR creator.

[Hanayoshi-8744]

Hi @wgtmac, this is my first contribution to Arrow. No rush at all, but I noticed the CI workflows for this PR seem to be stuck in "action_required" (likely pending approval for a first-time contributor). Could someone take a look when you have a chance? Thanks!

[wgtmac]

@kou Does this look good to you?

[kou]

@github-actions crossbow submit -g cpp -g r

[github-actions]

Revision: 1d1999a

Submitted crossbow builds: ursacomputing/crossbow @ actions-9cd9e6c731

Task	Status
example-cpp-minimal-build-static
example-cpp-minimal-build-static-system-dependency
example-cpp-tutorial
r-binary-packages
r-recheck-most
test-build-cpp-fuzz
test-conda-cpp
test-conda-cpp-valgrind
test-debian-13-cpp-amd64
test-debian-13-cpp-i386
test-debian-experimental-cpp-gcc-15
test-fedora-42-cpp
test-r-alpine-linux-cran
test-r-arrow-backwards-compatibility
test-r-depsource-system
test-r-dev-duckdb
test-r-devdocs
test-r-extra-packages
test-r-fedora-clang
test-r-gcc-11
test-r-gcc-12
test-r-install-local
test-r-install-local-minsizerel
test-r-linux-as-cran
test-r-linux-rchk
test-r-linux-sanitizers
test-r-linux-valgrind
test-r-m1-san
test-r-macos-as-cran
test-r-offline-maximal
test-r-ubuntu-22.04
test-r-versions
test-r-wasm
test-ubuntu-22.04-cpp
test-ubuntu-22.04-cpp-bundled
test-ubuntu-22.04-cpp-emscripten
test-ubuntu-22.04-cpp-no-threading
test-ubuntu-24.04-cpp
test-ubuntu-24.04-cpp-gcc-13-bundled
test-ubuntu-24.04-cpp-gcc-14
test-ubuntu-24.04-cpp-minimal-with-formats
test-ubuntu-24.04-cpp-thread-sanitizer

[kou]

+1

[kou]

Oh, Apache Thrift released 0.25.0 last week.

[matthewbayer]

Thanks for landing this! @kou @wgtmac - would you consider backporting it to a 26.0.1 patch release for CVE-2026-55969? I'm keen to take this upgrade without waiting on a new major release.

[kou]

Does the CVE really affect to Apache Parquet C++?

[Hanayoshi-8744]

Hi @kou, regarding "Does the CVE really affect Apache Parquet C++?": I looked into it, and I think it most likely does not with the default settings.

I also owe an apology: the PR description says this change is relevant to Arrow, which overstated the impact. I had only confirmed that the fix is in Thrift 0.24.0, not whether it is reachable through Arrow's defaults.

Arrow's ThriftDeserializer (the only place where Arrow reads Thrift data) passes a container size limit (default 1,000,000) to TCompactProtocolT, and Thrift checks it before the overflowing multiplication in checkReadBytesAvailable. I confirmed this with a small harness mimicking Arrow's setup, fed with a list header claiming 2^28 UUIDs (the case from the upstream regression test, apache/thrift@983c813c9a). With 0.22.0 (unoptimized build) it is rejected with SIZE_LIMIT at the default limit, and the size check is bypassed only if the limit is raised to well over 100 million or disabled (0, possible only via the C++ API). 0.24.0 rejects it in all cases.

Caveats: I only tested a list header on macOS arm64 with clang, not an end-to-end malicious file or Windows.

So I don't think the CVE alone justifies a backport, though that is your call.

(This analysis was done with the help of an AI tool, Claude Code; I reviewed the results.)