chore(docs): update dependency thrift to v0.24.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
thrift	==0.13.0 → ==0.24.0

---

Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

CVE-2026-41608 / GHSA-6pjx-3pjc-mrj8

More information

Details

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-41608
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
• http://www.openwall.com/lists/oss-security/2026/07/24/32
• https://github.com/advisories/GHSA-6pjx-3pjc-mrj8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

CVE-2026-43871 / GHSA-8wv5-x4w7-5gww

More information

Details

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-43871
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby
• http://www.openwall.com/lists/oss-security/2026/07/24/33
• https://github.com/advisories/GHSA-8wv5-x4w7-5gww

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

CVE-2026-66053 / GHSA-hwrj-9rr4-24xh

More information

Details

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

This replaces CVE-2026-41603

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-66053
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• https://lists.apache.org/thread/w4k5dnv1x58knwlhpo9x0or5xh220y65
• https://github.com/advisories/GHSA-hwrj-9rr4-24xh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-09-07 10:25 UTC

Review the latest changes.

Also blocked by: 1 required status check is failing.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.