diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md
index 462204c9c1..98ea673421 100644
--- a/NEXT_CHANGELOG.md
+++ b/NEXT_CHANGELOG.md
@@ -9,6 +9,7 @@
 - `UseBoundedSeaApi` and `EnableThriftNativeMetadata` now default to `1`; when unset, activation is controlled by the server-side `enableSqlExecForJdbc` rollout flag.
 - `DatabaseMetaData.getColumns(...)` with a `null` catalog now issues a single `SHOW COLUMNS IN ALL CATALOGS` statement (consistent with `getSchemas`/`getTables`) instead of enumerating every catalog and issuing a per-catalog `SHOW COLUMNS`. Older DBR versions that do not support the syntax transparently fall back to the previous enumerate-and-fan-out behavior.
 - Updated bundled Jackson, lz4-java, Netty, and Apache HttpComponents Client and Core dependencies to patched versions to address security findings.
+- Updated bundled Apache Thrift to 0.24.0 to address CVE-2026-43871.
 
 ### Fixed
 - Fixed later logging-enabled connections being unable to produce logs when an earlier connection
diff --git a/pom.xml b/pom.xml
index e2731bf6b7..5db4104b93 100644
--- a/pom.xml
+++ b/pom.xml
@@ -73,7 +73,7 @@
     <httpclient.version>4.5.14</httpclient.version>
     <async-httpclient.version>5.6.3</async-httpclient.version>
     <httpcore5.version>5.4.3</httpcore5.version>
-    <thrift.version>0.23.0</thrift.version>
+    <thrift.version>0.24.0</thrift.version>
     <slf4j.version>2.0.13</slf4j.version>
     <jackson.version>2.18.9</jackson.version>
     <gson.version>2.13.2</gson.version>
@@ -362,4 +362,4 @@
       </build>
     </profile>
   </profiles>
-</project>
\ No newline at end of file
+</project>