Conversation
apache/thrift < 0.24.0 is affected by GHSA-8wv5-x4w7-5gww / CVE-2026-43871 — an infinite loop in the PHP, Python, Go and Java bindings, severity high — so the whole previous '>=0.11, <0.17' range is unusable and 0.24.0 is the only release that is not. 0.24.0 itself requires PHP ^8.1; this major goes to ^8.4 so the toolchain can land on current stable releases. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three fixes, all enabled by the new baseline: * socket_create() returns a Socket object since PHP 8.0, so the is_resource($this->socket) guard in connect() was always false and a fresh socket was created on every flush(). Descriptors did not leak — the old socket was collected immediately — but each flush paid for a needless socket_create() plus socket_connect(), and close() was a no-op in practice. * Match the parameter types of the now strictly typed TTransport in 0.24: read(int $len): string and write(string $buf): void. * read() returned '' unconditionally, so the inherited readAll() spun forever in while (strlen($data) < $len). Unreachable for the emit-only agent client, but it is the same infinite-loop shape as CVE-2026-43871. It throws TTransportException now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The tree was generated by compiler 0.15 while the runtime is now 0.24. Regenerating against jaeger-idl v0.12.0 aligns the two: * declare(strict_types=1) in every file (THRIFT-5986) * native property and constructor types (THRIFT-5991), so 'public $key' becomes 'public ?string $key' — which is what the IDL actually says * native return types on struct methods (THRIFT-5990) * PSR-12 layout (THRIFT-5959) bin/thrift-gen.sh cloned jaeger-idl from a moving 'main', so two runs a month apart could differ with no record of what changed. It now pins jaeger-idl v0.12.0, refuses to run unless the compiler is 0.24.x, generates into a mktemp directory cleaned up by a trap instead of leaving a clone in the working tree, and drops a dead 'rm -rf ../src/Jaeger/Thrift/' from an older layout. Running it twice is now a no-op. BREAKING: 24 classes are gone — AggregationValidator, BaggageRestrictionManager, Dependency and ThrottlingService with their DTOs. They came from IDL definitions Jaeger removed upstream long ago (already absent in jaeger-idl v0.11.4); they are server-side APIs this client never used. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of five stacked PRs for the 4.0 major.
Why
apache/thrift< 0.24.0 is affected by CVE-2026-43871 (GHSA-8wv5-x4w7-5gww) — an infinite loop in the PHP, Python, Go and Java bindings, severity high. The whole previous>=0.11, <0.17range is unusable and 0.24.0 is the only release that is not.What
apache/thrift: ^0.24.0,php: ^8.4(0.24 itself needs ^8.1; the major targets 8.4 so the toolchain lands on current stable releases)TUDPTransportmodernised — see belowsrc/Thriftregenerated with compiler 0.24 againstjaeger-idlv0.12.0TUDPTransport
socket_create()returns aSocketobject since PHP 8.0, sois_resource($this->socket)was always false and a fresh socket was created on everyflush(). Descriptors did not leak, but each flush paid for a needlesssocket_create()+socket_connect(), andclose()was a no-op in practice.TTransportin 0.24.read()returned''unconditionally, so the inheritedreadAll()spun forever — the same infinite-loop shape as the CVE. It throwsTTransportExceptionnow.Regeneration
The tree was generated by compiler 0.15 while the runtime is 0.24. Regenerating brings them in line:
declare(strict_types=1)(THRIFT-5986), native property/constructor types (THRIFT-5991) sopublic $keybecomespublic ?string $key, native return types (THRIFT-5990), PSR-12 (THRIFT-5959).bin/thrift-gen.shcloned the IDL from a movingmain. It now pinsv0.12.0, requires compiler 0.24.x, and generates into amktempdir. Running it twice is a no-op — verified.24 classes removed:
AggregationValidator,BaggageRestrictionManager,Dependency,ThrottlingServiceand their DTOs. They came from IDL definitions Jaeger removed upstream long ago (already absent injaeger-idlv0.11.4) — server-side APIs this client never used. Nothing insrc/ortests/referenced them.Verified
Struct round-trips over binary and compact protocols,
AgentClient::emitBatchover a real UDP socket, and the reflection contract againstTTransport.