afs commented on PR #3906: URL: https://github.com/apache/jena/pull/3906#issuecomment-4496242901
> When will there be a release with this fix? How do you use Jena? library or Fuseki? Jena only uses Thrift for encode/decode in a binary RDF format, not the inter-machine communication part. Apache Thrift has several implementations for different language ecosystems. Apache Jena binary releases only include the java artifact `libthrift` from Apache Thrift which does not include any Thrifty code from other language binaries. There was a batch of Thrift security announcement in April: https://lists.apache.org/[email protected]:2026-4 [CVE-2026-41603](https://www.cve.org/CVERecord?id=CVE-2026-41603) is java related. Jena does not use this facility in the RPC part of Thrift. (it seems to be the same as [CVE-2026-43869](https://www.cve.org/CVERecord?id=CVE-2026-43869) > [CVE-2026-41604](https://github.com/advisories/GHSA-r4rx-ffxv-23vw) This seems to relate to the Swift language form of Thrift. Jena binary release do not include this code. > [CVE-2026-41636](https://github.com/advisories/GHSA-r67j-r569-jrwp) Jena does not ship the Apache Thrift JS code. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
