thrift CVE-2026-43868 via parquet 58 — fix is parquet 59, blocked on Ballista > 54

Aperta
  • Qualcosa non va?
#4 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
backend, security

Direzione di ricerca

Read docs/dependencies.md rule 4 and check Ballista’s latest DataFusion requirement; the issue says the required release is not available yet. Once Ballista targets DataFusion 55, update the dependency chain and inspect Cargo.lock for any remaining thrift entry. Remove the GHSA ignore from deny.toml and the known advisory from SECURITY.md, then run make coherence.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

help wanted

Today — Cargo.lock resolves thrift 0.17.0, reached only through parquet 58.4.0 → thrift ^0.17 (→ datafusion 54 → ballista 54). GitHub's advisory database reports it as CVE-2026-43868 / GHSA-2f9f-gq7v-9h6m, medium: excessive memory allocation from a size value during decode. cargo deny check passes because RustSec does not carry the advisory yet; the acceptance is already recorded in deny.toml so the gate stays green with the reason on file when it does.

$ cargo tree -i thrift -e normal
thrift v0.17.0
└── parquet v58.4.0
    └── datafusion v54.1.0
        └── ballista v54.1.0
$ parquet 58.4.0 requires thrift ^0.17

Why it is worth tracking — Thrift is how a Parquet footer is decoded, so the vulnerable path is entered by opening a Parquet file. For an engine whose entire storage layer is Parquet, that is the front door. SECURITY.md scopes input files to infrastructure you control, which bounds it today; it does not close it.

Fix — not a thrift bump. Measured on crates.io:

parquet 59.0.0 … 59.3.0   thrift: (none)      # upstream removed the dependency
ballista 54.1.0 (newest)  datafusion ^54      # parquet 59 needs datafusion 55

So the fix is the chain bump ballista → datafusion 55 → parquet 59, and it is blocked until a Ballista release targets DataFusion 55 (docs/dependencies.md, rule 4: "Ballista wins until it moves"). Nothing OxideLake can do inside the pinned set short-circuits it.

Done when —

  • Cargo.lock has no thrift entry (parquet ≥ 59 in the chain).
  • The GHSA-2f9f-gq7v-9h6m ignore is removed from deny.toml and the entry from SECURITY.md's known-advisories list.
  • make coherence still reports one major per chain crate after the bump.

Unmilestoned on purpose: the trigger is upstream. Re-check Ballista's newest datafusion requirement at every chain review.

Lingua principale
Rust
Stelle
1
Fork
2
Merge medio
1g 11h
PR unite (30g)
7

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di vyncint/oxidelake

Tutte le issue di vyncint/oxidelake

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.