{
  "@id": "urn:uuid:c9cc5e98-eda9-44bf-9d7d-ed99af3f49bf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5397 is fixed in version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2016-5397"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11938 affects version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-11938"
      },
      "action_statement": "Vulnerability CVE-2019-11938 affects version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11939 is fixed in version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-11939"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3552 affects version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3552"
      },
      "action_statement": "Vulnerability CVE-2019-3552 affects version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3553 is fixed in version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3553"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3558 is fixed in version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3558"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3564 is fixed in version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3564"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3565 is fixed in version 0.9.3-tuxcare.4 of org.apache.thrift:libfb303.",
      "vulnerability": {
        "name": "CVE-2019-3565"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24028 is a false positive for org.apache.thrift:libfb303 0.9.3-tuxcare.4. CVE-2021-24028 is a false positive for this repository. The vulnerability affects Facebook Thrift (fbthrift), a separate fork maintained by Meta at github.com/facebook/fbthrift with features like table-based serialization. This repository is Apache Thrift 0.9.3, the original Apache Software Foundation project, which does not contain Facebook Thrift code, has no vendored copy of it, and declares no dependency on it. The two projects diverged significantly, and Facebook Thrift's table-based serialization feature does not exist in Apache Thrift.",
      "vulnerability": {
        "name": "CVE-2021-24028"
      },
      "impact_statement": "CVE-2021-24028 is a false positive for this repository. The vulnerability affects Facebook Thrift (fbthrift), a separate fork maintained by Meta at github.com/facebook/fbthrift with features like table-based serialization. This repository is Apache Thrift 0.9.3, the original Apache Software Foundation project, which does not contain Facebook Thrift code, has no vendored copy of it, and declares no dependency on it. The two projects diverged significantly, and Facebook Thrift's table-based serialization feature does not exist in Apache Thrift."
    }
  ]
}