{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c65395d-fe9b-5f2f-a5a8-83d5e52b6dfa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "libthrift", "purl": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3", "type": "library", "group": "org.apache.thrift", "bom-ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3", "version": "0.14.1-tuxcare.3", "pedigree": { "ancestors": [ { "name": "libthrift", "purl": "pkg:maven/org.apache.thrift/libthrift@0.14.1", "type": "library", "group": "org.apache.thrift", "version": "0.14.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11798", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:ff755f4e-2c69-5e71-88fe-475766744d90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11798 does not affect version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift. not_affected \u2014 CVE-2018-11798 affects Apache Thrift Node.js static web server versions 0.9.2-0.11.0, allowing path traversal to access files outside the document root. The target (version 0.14.1) contains the upstream fix from October 2018 (commit 2a2b72f6c by jfarrell@apache.org). The fix uses path.resolve() to normalize paths and validates that resolved paths remain within baseDir boundaries. This fix was a...", "justification": "code_not_present" } }, { "id": "CVE-2018-1320", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:788833e4-5b46-52cc-b3a7-d84b2a126d08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1320 does not affect version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift. The target repository (Apache Thrift 0.14.1-tuxcare.3) is not affected by CVE-2018-1320. The vulnerability involved using Java assertions for security-critical SASL handshake validation, which could be disabled in production with the -da JVM flag. The fix (commit 7489ed6ac) was already present in upstream Apache Thrift version 0.14.1 before TuxCare onboarded it. The vulnerable code pattern (assert sasl.isComplete() and premature break in the client negotiation loop) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.5.0, < 0.9.3-1; >= 0.10.0, < 0.12.0), NVD (>= 0.5.0, <= 0.11.0), cve.org (>= 0.5.0, <= 0.11.0), Snyk (>= 0.6.1, < 0.9.3-1; >= 0.10.0, < 0.12.0).", "justification": "code_not_present" } }, { "id": "CVE-2019-0205", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:ca06f8c1-b64a-5b65-bcf4-6871f040a961", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0205 does not affect version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift. Apache Thrift 0.14.1 is NOT affected by CVE-2019-0205. The vulnerability (endless loop when processing invalid TType values in skip() functions) was fixed upstream in commit dbc1f8def (February 2019) by James E. King III. This fix was already present in the Apache Thrift 0.14.1 release that TuxCare onboarded in June 2026. All examined language bindings (Python, C++, Ruby, C_glib, Node.js, Go, Java, PHP) correctly throw exceptions when encountering invalid TType values, preventing the endless loop condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.13.0), NVD (<= 0.12.0), cve.org (<= 0.12.0), Snyk (< 0.13.0).", "justification": "code_not_present" } }, { "id": "CVE-2020-13949", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:753a79e6-a72c-5288-a4bd-8febc4f677da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13949 does not affect version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift. The target Apache Thrift 0.14.1 is not affected by CVE-2020-13949. The vulnerability was fixed in upstream commit 86352b482 (THRIFT-5237) on June 15, 2020, which introduced the TConfiguration class with MAX_MESSAGE_SIZE limits and validation via checkReadBytesAvailable(). This fix was already included in the upstream 0.14.1 release (March 2, 2021) before TuxCare onboarded it. The CVE affects versions 0.9.3 to 0.13.0, while the target is 0.14.1, which contains the complete fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 0.9.3, < 0.14.0), NVD (>= 0.9.3, <= 0.13.0), cve.org (>= 0.9.3, <= 0.13.0), Snyk (>= 0, < 0.14.0).", "justification": "code_not_present" } }, { "id": "CVE-2026-120135", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:5704ed41-e052-59ed-b710-8fa687e7e751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120135 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-41603", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:0457ae79-4a38-547b-b21a-f0ee6672960f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41603 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-43869", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:b751fc26-ed4e-5e40-8ef5-aceb6405170b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43869 is fixed in version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-43871", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:7f467748-dcc3-5ff5-9ea0-bd3ab63f719f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43871 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-48586", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:0a09aefd-5660-5c21-90e0-3aeea4a5655f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48586 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-61373", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:d9e0c6bd-928c-5381-b873-35322f30ced0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61373 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-61374", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:e18ab4d6-d8ba-5dd4-8254-546bfdd19286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61374 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-66055", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:137b322f-ef70-54b1-90bd-bee943bb147a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66055 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-82458", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:5d6902c4-a894-5e8b-8be2-82abb8bdef04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82458 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-94639", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:773084b3-4640-571b-b3fa-96371e9b5c28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94639 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } }, { "id": "CVE-2026-94651", "affects": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ], "bom-ref": "urn:uuid:7c1f62db-a4b2-5210-8f27-e15ec946ed00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-94651 affects version 0.14.1-tuxcare.3 of org.apache.thrift:libthrift." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.thrift/libthrift@0.14.1-tuxcare.3" } ] }