Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/312568?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "type": "apk", "namespace": "alpine", "name": "thrift", "version": "0.23.0-r0", "qualifiers": { "arch": "x86_64", "distroversion": "edge", "reponame": "community" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61742?format=api", "vulnerability_id": "VCID-3p5b-ucbp-7bax", "summary": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41604.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41604.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41604", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21701", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21687", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21593", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21643", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21584", "published_at": "2026-06-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41604" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41604", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41604" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463416", "reference_id": "2463416", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463416" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14885", "reference_id": "RHSA-2026:14885", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14885" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41604" ], "risk_score": 3.7, "exploitability": "0.5", "weighted_severity": "7.4", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3p5b-ucbp-7bax" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61740?format=api", "vulnerability_id": "VCID-4k9d-m5vr-f7ck", "summary": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41605.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41605.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41605", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.13962", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14055", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14018", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.13933", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14054", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41605" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41605", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41605" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463418", "reference_id": "2463418", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463418" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14885", "reference_id": "RHSA-2026:14885", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14885" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41605" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "6.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4k9d-m5vr-f7ck" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/102425?format=api", "vulnerability_id": "VCID-6vaq-uu2j-5kcq", "summary": "Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal \"free(): invalid pointer\" error message.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48431.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-48431.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-48431", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00088", "scoring_system": "epss", "scoring_elements": "0.25279", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00088", "scoring_system": "epss", "scoring_elements": "0.25262", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00088", "scoring_system": "epss", "scoring_elements": "0.25212", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00088", "scoring_system": "epss", "scoring_elements": "0.25155", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00088", "scoring_system": "epss", "scoring_elements": "0.25163", "published_at": "2026-06-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-48431" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48431", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48431" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348", "reference_id": "1135348", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463410", "reference_id": "2463410", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463410" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2025-48431" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6vaq-uu2j-5kcq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61745?format=api", "vulnerability_id": "VCID-7f8k-ku7f-byfz", "summary": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41602.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41602.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41602", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22209", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22308", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22295", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22248", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22195", "published_at": "2026-06-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41602" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41602", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41602" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/thrift", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/thrift" }, { "reference_url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-28T14:09:11Z/" } ], "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2026/04/28/6", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2026/04/28/6" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348", "reference_id": "1135348", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407", "reference_id": "2463407", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14162", "reference_id": "RHSA-2026:14162", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14885", "reference_id": "RHSA-2026:14885", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14885" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24503", "reference_id": "RHSA-2026:24503", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24503" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41602", "GHSA-wf45-q9ch-q8gh" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7f8k-ku7f-byfz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61738?format=api", "vulnerability_id": "VCID-e8t2-ty15-bqd6", "summary": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41606.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41606.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41606", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22127", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22215", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22169", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22114", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00073", "scoring_system": "epss", "scoring_elements": "0.22228", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41606" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41606", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41606" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348", "reference_id": "1135348", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463408", "reference_id": "2463408", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463408" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14885", "reference_id": "RHSA-2026:14885", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14885" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41606" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e8t2-ty15-bqd6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61743?format=api", "vulnerability_id": "VCID-hqy9-1w3k-rqd2", "summary": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41603.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41603.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41603", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00028", "scoring_system": "epss", "scoring_elements": "0.08278", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00028", "scoring_system": "epss", "scoring_elements": "0.08329", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00028", "scoring_system": "epss", "scoring_elements": "0.08311", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00028", "scoring_system": "epss", "scoring_elements": "0.08259", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00028", "scoring_system": "epss", "scoring_elements": "0.08317", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41603" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41603", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41603" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348", "reference_id": "1135348", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411", "reference_id": "2463411", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14885", "reference_id": "RHSA-2026:14885", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14885" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41603" ], "risk_score": 3.7, "exploitability": "0.5", "weighted_severity": "7.4", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hqy9-1w3k-rqd2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61736?format=api", "vulnerability_id": "VCID-jt95-c4ye-ybct", "summary": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41607.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41607.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41607", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00069", "scoring_system": "epss", "scoring_elements": "0.21352", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00069", "scoring_system": "epss", "scoring_elements": "0.21453", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00069", "scoring_system": "epss", "scoring_elements": "0.21405", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00069", "scoring_system": "epss", "scoring_elements": "0.21342", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00069", "scoring_system": "epss", "scoring_elements": "0.21467", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41607" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41607", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41607" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348", "reference_id": "1135348", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135348" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463412", "reference_id": "2463412", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463412" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:14885", "reference_id": "RHSA-2026:14885", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:14885" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41607" ], "risk_score": 4.1, "exploitability": "0.5", "weighted_severity": "8.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jt95-c4ye-ybct" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/61735?format=api", "vulnerability_id": "VCID-u4wd-ke9h-j7ck", "summary": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41636.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-41636.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41636", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00255", "scoring_system": "epss", "scoring_elements": "0.49053", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00255", "scoring_system": "epss", "scoring_elements": "0.49077", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00255", "scoring_system": "epss", "scoring_elements": "0.49086", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00255", "scoring_system": "epss", "scoring_elements": "0.4907", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00255", "scoring_system": "epss", "scoring_elements": "0.4904", "published_at": "2026-06-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41636" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41636", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41636" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/apache/thrift", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/thrift" }, { "reference_url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-28T12:15:08Z/" } ], "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2026/04/28/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2026/04/28/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463404", "reference_id": "2463404", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463404" }, { "reference_url": "https://github.com/advisories/GHSA-r67j-r569-jrwp", "reference_id": "GHSA-r67j-r569-jrwp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r67j-r569-jrwp" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:21769", "reference_id": "RHSA-2026:21769", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:21769" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22347", "reference_id": "RHSA-2026:22347", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22347" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:22423", "reference_id": "RHSA-2026:22423", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:22423" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:23345", "reference_id": "RHSA-2026:23345", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:23345" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:24539", "reference_id": "RHSA-2026:24539", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:24539" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/312568?format=api", "purl": "pkg:apk/alpine/thrift@0.23.0-r0?arch=x86_64&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2026-41636", "GHSA-r67j-r569-jrwp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-u4wd-ke9h-j7ck" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/thrift@0.23.0-r0%3Farch=x86_64&distroversion=edge&reponame=community" }