{
  "@id": "urn:uuid:c137a04c-45e8-47d0-abe9-49b4464c86be",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-02T13:12:59.799090+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-3254 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2015-3254"
      },
      "action_statement": "Vulnerability CVE-2015-3254 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5397 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2016-5397"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1320 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2018-1320"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-0205 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-0205"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11938 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-11938"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11939 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-11939"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3552 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3552"
      },
      "action_statement": "Vulnerability CVE-2019-3552 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3553 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3553"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3558 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3558"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3564 is fixed in version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3564"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3565 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303, and is fixed in 0.9.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2019-3565"
      },
      "action_statement": "Vulnerability CVE-2019-3565 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303, and is fixed in 0.9.1-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24028 is a false positive for org.apache.thrift:libfb303 0.9.1-tuxcare.3. CVE-2021-24028 is a wrong-project match. The advisory concerns Facebook Thrift's (fbthrift) table-based serialization feature, which does not exist in Apache Thrift 0.9.1. Apache Thrift and Facebook Thrift are distinct products that diverged after Facebook's fork ~2014. The affected component code is absent from this repository (no table-based serialization, no vendored fbthrift code, no fbthrift dependencies).",
      "vulnerability": {
        "name": "CVE-2021-24028"
      },
      "impact_statement": "CVE-2021-24028 is a wrong-project match. The advisory concerns Facebook Thrift's (fbthrift) table-based serialization feature, which does not exist in Apache Thrift 0.9.1. Apache Thrift and Facebook Thrift are distinct products that diverged after Facebook's fork ~2014. The affected component code is absent from this repository (no table-based serialization, no vendored fbthrift code, no fbthrift dependencies)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43869 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-43869"
      },
      "action_statement": "Vulnerability CVE-2026-43869 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43871 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-43871"
      },
      "action_statement": "Vulnerability CVE-2026-43871 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48586 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-48586"
      },
      "action_statement": "Vulnerability CVE-2026-48586 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-02T11:31:04.185792+00:00",
      "status_notes": "Vulnerability CVE-2026-61373 does not affect version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303. not_affected \u2014 CVE-2026-61373 affects Apache Thrift Java TSaslNonblockingServer, which does not exist in version 0.9.1. The TSaslNonblockingServer class was introduced in commit 6e023df1d (September 2019) and first appeared in version 0.14.1. The target version 0.9.1 predates the introduction of this component by several years and multiple major versions. Since the vulnerable component is not present in the c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-61373"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-61373 affects Apache Thrift Java TSaslNonblockingServer, which does not exist in version 0.9.1. The TSaslNonblockingServer class was introduced in commit 6e023df1d (September 2019) and first appeared in version 0.14.1. The target version 0.9.1 predates the introduction of this component by several years and multiple major versions. Since the vulnerable component is not present in the c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-02T13:12:59.799090+00:00",
      "status_notes": "Vulnerability CVE-2026-61374 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-61374"
      },
      "action_statement": "Vulnerability CVE-2026-61374 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-02T13:12:59.799090+00:00",
      "status_notes": "Vulnerability CVE-2026-66055 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-66055"
      },
      "action_statement": "Vulnerability CVE-2026-66055 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-02T12:45:13.890718+00:00",
      "status_notes": "Vulnerability CVE-2026-82458 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-82458"
      },
      "action_statement": "Vulnerability CVE-2026-82458 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-02T09:51:01.549183+00:00",
      "status_notes": "Vulnerability CVE-2026-94639 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-94639"
      },
      "action_statement": "Vulnerability CVE-2026-94639 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-02T10:50:17.705539+00:00",
      "status_notes": "Vulnerability CVE-2026-94651 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2026-94651"
      },
      "action_statement": "Vulnerability CVE-2026-94651 affects version 0.9.1-tuxcare.3 of org.apache.thrift:libfb303."
    }
  ]
}