Bump Apache parent POM from 37 to 38. Update Apache Thrift from 0.22.0 to 0.23.0.

[afs]

• Update Apache parent POM
• Update for Apache Thrift
• Tidy up module names.
• Fix some javadoc

---

By submitting this pull request, I acknowledge that I am making a contribution to the Apache Software Foundation under the terms and conditions of the Contributor's Agreement.

[SEITENBAU-SBornholdt]

When will there be a release with this fix? We would like to patch CVE-2026-41604 and CVE-2026-41636 in our system.

[afs]

When will there be a release with this fix?

How do you use Jena? library or Fuseki?

Jena only uses Thrift for encode/decode in a binary RDF format, not the inter-machine communication part.

Apache Thrift has several implementations for different language ecosystems.
Apache Jena binary releases only include the java artifact libthrift from Apache Thrift which does not include any Thrifty code from other language binaries.

There was a batch of Thrift security announcement in April:
https://lists.apache.org/list?announce@apache.org:2026-4

CVE-2026-41603 is java related.
Jena does not use this facility in the RPC part of Thrift.
(it seems to be the same as CVE-2026-43869)

CVE-2026-41604

This seems to relate to the Swift language form of Thrift. Jena binary release do not include this code.

CVE-2026-41636

Jena does not ship the Apache Thrift JS code.

[SEITENBAU-SBornholdt]

We use Fuseki @seitenbau-govdata . Do you think the CVEs do not apply to jena and therefore fuseki?

[afs]

I can't give you a formal response.

Use of Fuseki is under the terms of the license.

All open source licenses have similar provisions; otherwise, open source would not exist.

It is up to Seitenbau to verify and endorse that the software is fit for purpose as part of any contract with a customer.

The two CVEs you point out are not Java related as far as I can determin - that's no more than a personal opinion. There should not be any code related to them in Fuseki. That can be checked by looking inside the Fuseki jar file.

@seitenbau-govdata does not have anything publicly visible in it.