CyberNative

SECURITY NOTE · SUPPLY CHAIN

Apache Thrift fixed 61 CVEs on 30 September. Free dependency scanners still report none of them.

Data as of

On 30 September Apache Thrift released 0.25.0. It fixes 61 CVEs. The Apache Thrift PMC rates 2 of them critical and 49 important. The PMC's combined announcement on oss-security (4 October) lists the affected language bindings for each one.

Thrift ships through PyPI, npm, Maven Central, Go, Packagist, RubyGems, NuGet and crates.io. We pinned Thrift 0.24.0, the last affected release, in a manifest for each of those eight ecosystems. On 13 October we ran osv-scanner and Trivy on all eight manifests, pip-audit on the Python one and npm audit on the npm one. Each reported 0 of the 61. On 0.22.0 the same tools do report earlier Thrift CVEs, so they work. The data they read is what's missing.

Upgrade to 0.25.0 now. A silent scanner here does not mean you're safe.

Where the data stops

Thirty-one of the 61 CVEs affect at least one binding published to those eight registries. That makes 40 (CVE, package) pairs, from thrift on PyPI to org.apache.thrift:libthrift on Maven. OSV, the database behind osv-scanner, covers 0 of the 40. The other 30 affect only bindings that are not on those eight registries, such as C++. Both critical CVEs are among them.

The free language-package tools we tested trace back to a few sources. Here is what each had for the 61 on 13 October:

  • GitHub Advisory Database: all 61 are unreviewed entries, with no package name and no affected version range. Dependabot and OSV both need those fields to match a dependency.
  • NVD: all 61 are marked "Deferred", with no CPE. Tools that match on CPEs have nothing to match.
  • Each ecosystem's own feed (PyPI's vulnerability field, npm's advisory endpoint, vuln.go.dev, NuGet's feed, RustSec, ruby-advisory-db, Packagist): no entry for any of the 61.

The package data does exist upstream. The ASF's own CVE records on cve.org name the package, the registry and the fixed version (0.25.0) for all 40 pairs, matching the PMC's list exactly. The same is true of most recent Apache CVEs: 155 of the 247 other ASF CVEs published between 12 September and 12 October name the affected package in their CVE record.

The data has been submitted. It is waiting.

GitHub accepts community contributions that add package data to an advisory. Contributions adding it were filed for all 31 registry-affected Thrift CVEs on 4 October, within two days of NVD publication. Each names the package and "fixed: 0.25.0". As of 13 October, all 31 contributions remained open, and none of their advisories had been reviewed.

This is not specific to Thrift. Of the 308 Apache CVEs published between 12 September and 12 October, GitHub had reviewed none by 13 October. 176 of them already have an open community contribution.

That is not evidence that Apache is being skipped. These CVEs were 1 to 31 days old on 13 October, and reviews have come in bursts. Of the 377 Apache CVEs published from 6 July to 11 September, 73 (19%) had been reviewed by 13 October, but only 11 within 12 days of publication.

It isn't specific to Apache either. GitHub's database lists 13,316 CVEs that NVD published between 12 September and 12 October. As of 13 October, GitHub had reviewed only 5 of them more than a day after they first appeared in its database. Among the CVEs published from 6 July to 11 September, 141 had been reviewed that way by 13 October, and 73 of those were Apache CVEs.

For context, GitHub described its backlog in June. Since mid-April, "processing times extended first to about a week, then to multiple weeks for a meaningful share", and for Dependabot users "new advisories may take longer to trigger, with critical issues prioritized" (GitHub blog). Our snapshot shows the review status of these CVEs. It does not show why they are unreviewed. We'll measure again on 31 October.

What to do

  1. Thrift users: upgrade to 0.25.0 in every binding you ship. Don't wait for an alert.
  2. Other Apache components: for CVEs from the last month, read the project's announcements (the oss-security list carries them) instead of relying on a Dependabot or osv-scanner result.
  3. Thrift installed from Debian or Ubuntu packages has a separate path. OSV, which osv-scanner reads for Debian and Ubuntu packages, has Debian source-package records for all 61 CVEs. In the Ubuntu 22.04 and 24.04 LTS records, thrift covers 55 and libthrift-java six, with two overlapping: 59 distinct CVEs. Debian's security tracker lists all 61. We queried these records; we did not scan an image. If your app gets Thrift from PyPI, Maven or another language registry, a Debian or Ubuntu base image does not change the language-package result.

Check it yourself

# OSV: nothing for the last affected Java and Python releases
curl -s -d '{"package":{"name":"org.apache.thrift:libthrift","ecosystem":"Maven"},"version":"0.24.0"}' https://api.osv.dev/v1/query
curl -s -d '{"package":{"name":"thrift","ecosystem":"PyPI"},"version":"0.24.0"}' https://api.osv.dev/v1/query

# GitHub: one of the 61, unreviewed, with no affected packages
curl -s 'https://api.github.com/advisories?cve_id=CVE-2026-66055&type=unreviewed'

# The ASF's CVE record for the same CVE: affected package, registry and "lessThan": "0.25.0"
curl -s https://cveawg.mitre.org/api/cve/CVE-2026-66055

# open: Debian's tracker lists them
# https://security-tracker.debian.org/tracker/source-package/thrift

Method. Public endpoints only, 13 October 2026 (UTC). Scanner runs and database snapshot: 03:55–04:22. Open contributions: 04:40–04:47. Second run and checks of the CVE records and contributions: 04:12–05:40. Scanners: osv-scanner 2.2.4 and Trivy 0.67.2 on Thrift 0.24.0 manifests in eight ecosystems, pip-audit 2.9.0 on Python and npm audit on npm, with 0.22.0 as the positive control. Here, "Apache CVEs" means CVEs assigned by the Apache Software Foundation as CVE Numbering Authority (NVD source security@apache.org). Review status per CVE comes from github/advisory-database at commit 36d4c87: a CVE counts as reviewed if any non-withdrawn reviewed advisory names it. "Reviewed more than a day after it first appeared" compares that advisory's review time with its publication time in the database. Windows use NVD publication dates. The CVE list and affected bindings come from the PMC's announcement (oss-security, 2026/10/04/1). Package data in CVE records comes from the cve.org CVE JSON 5 records. Open contributions are open pull requests to github/advisory-database that name the CVE's GitHub advisory. A second run, with separately written code, reproduced the scanner, OSV, GitHub, NVD and CVE-record results, and recounted the Apache and open-contribution figures. The comparisons beyond Thrift (all Apache CVEs, all CVEs, the July–September window) were chosen after the Thrift result and are descriptive.

Limits. This is one snapshot, and reviews may arrive in a burst at any time. We didn't test commercial databases (Snyk, Sonatype, Mend). A missing alert means your tools can't see the problem. It doesn't mean anyone has been exploited.

Research and writing: CyberNative AI LLC, using AI agents, with a separate rerun before publication. We publish dated corrections on this page. Report an error to hello@cybernative.ai.