{
  "@id": "urn:uuid:9c6d4f29-b536-4c01-a707-0dcd2a63e651",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T04:50:52.238629+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-3254 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2015-3254"
      },
      "action_statement": "Vulnerability CVE-2015-3254 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5397 is fixed in version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2016-5397"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:50:52.238629+00:00",
      "status_notes": "Vulnerability CVE-2018-11798 does not affect version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift. not_affected \u2014 Apache Thrift version 0.9.1-tuxcare.4 is not affected by CVE-2018-11798. The vulnerable component (lib/nodejs/lib/thrift/web_server.js) does not exist in this version. The Node.js static web server was introduced in THRIFT-2355 on March 7, 2014, after the 0.9.1 release (August 2013). The CVE correctly identifies affected versions as \"0.9.2 through 0.11.0\" - version 0.9.1 predates the introducti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11798"
      },
      "impact_statement": "not_affected \u2014 Apache Thrift version 0.9.1-tuxcare.4 is not affected by CVE-2018-11798. The vulnerable component (lib/nodejs/lib/thrift/web_server.js) does not exist in this version. The Node.js static web server was introduced in THRIFT-2355 on March 7, 2014, after the 0.9.1 release (August 2013). The CVE correctly identifies affected versions as \"0.9.2 through 0.11.0\" - version 0.9.1 predates the introducti..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1320 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2018-1320"
      },
      "action_statement": "Vulnerability CVE-2018-1320 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-0205 is fixed in version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2019-0205"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11938 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-11938"
      },
      "action_statement": "Vulnerability CVE-2019-11938 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11939 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-11939"
      },
      "action_statement": "Vulnerability CVE-2019-11939 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3552 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2019-3552"
      },
      "action_statement": "Vulnerability CVE-2019-3552 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3553 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-3553"
      },
      "action_statement": "Vulnerability CVE-2019-3553 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3558 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-3558"
      },
      "action_statement": "Vulnerability CVE-2019-3558 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3564 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-3564"
      },
      "action_statement": "Vulnerability CVE-2019-3564 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3565 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2019-3565"
      },
      "action_statement": "Vulnerability CVE-2019-3565 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift, and is fixed in 0.9.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:13:36.432303+00:00",
      "status_notes": "Vulnerability CVE-2020-13949 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2020-13949"
      },
      "action_statement": "Vulnerability CVE-2020-13949 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24028 is a false positive for org.apache.thrift:libthrift 0.9.1-tuxcare.1. CVE-2021-24028 is a wrong-project match. The advisory concerns Facebook Thrift's (fbthrift) table-based serialization feature, which does not exist in Apache Thrift 0.9.1. Apache Thrift and Facebook Thrift are distinct products that diverged after Facebook's fork ~2014. The affected component code is absent from this repository (no table-based serialization, no vendored fbthrift code, no fbthrift dependencies).",
      "vulnerability": {
        "name": "CVE-2021-24028"
      },
      "impact_statement": "CVE-2021-24028 is a wrong-project match. The advisory concerns Facebook Thrift's (fbthrift) table-based serialization feature, which does not exist in Apache Thrift 0.9.1. Apache Thrift and Facebook Thrift are distinct products that diverged after Facebook's fork ~2014. The affected component code is absent from this repository (no table-based serialization, no vendored fbthrift code, no fbthrift dependencies)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:13.594930+00:00",
      "status_notes": "Vulnerability CVE-2026-120135 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-120135"
      },
      "action_statement": "Vulnerability CVE-2026-120135 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T20:57:02.357406+00:00",
      "status_notes": "Vulnerability CVE-2026-41603 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-41603"
      },
      "action_statement": "Vulnerability CVE-2026-41603 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43869 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-43869"
      },
      "action_statement": "Vulnerability CVE-2026-43869 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43871 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-43871"
      },
      "action_statement": "Vulnerability CVE-2026-43871 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48586 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-48586"
      },
      "action_statement": "Vulnerability CVE-2026-48586 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T11:31:04.185792+00:00",
      "status_notes": "Vulnerability CVE-2026-61373 does not affect version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift. not_affected \u2014 CVE-2026-61373 affects Apache Thrift Java TSaslNonblockingServer, which does not exist in version 0.9.1. The TSaslNonblockingServer class was introduced in commit 6e023df1d (September 2019) and first appeared in version 0.14.1. The target version 0.9.1 predates the introduction of this component by several years and multiple major versions. Since the vulnerable component is not present in the c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-61373"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-61373 affects Apache Thrift Java TSaslNonblockingServer, which does not exist in version 0.9.1. The TSaslNonblockingServer class was introduced in commit 6e023df1d (September 2019) and first appeared in version 0.14.1. The target version 0.9.1 predates the introduction of this component by several years and multiple major versions. Since the vulnerable component is not present in the c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T13:12:59.799090+00:00",
      "status_notes": "Vulnerability CVE-2026-61374 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-61374"
      },
      "action_statement": "Vulnerability CVE-2026-61374 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T13:12:59.799090+00:00",
      "status_notes": "Vulnerability CVE-2026-66055 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-66055"
      },
      "action_statement": "Vulnerability CVE-2026-66055 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T12:45:13.890718+00:00",
      "status_notes": "Vulnerability CVE-2026-82458 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-82458"
      },
      "action_statement": "Vulnerability CVE-2026-82458 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T09:51:01.549183+00:00",
      "status_notes": "Vulnerability CVE-2026-94639 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-94639"
      },
      "action_statement": "Vulnerability CVE-2026-94639 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libthrift@0.9.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T10:50:17.705539+00:00",
      "status_notes": "Vulnerability CVE-2026-94651 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift.",
      "vulnerability": {
        "name": "CVE-2026-94651"
      },
      "action_statement": "Vulnerability CVE-2026-94651 affects version 0.9.1-tuxcare.1 of org.apache.thrift:libthrift."
    }
  ]
}