{"metadata": {"vulnerability": "CVE-2026-43871", "count": 90, "kinds": {"milestone": 23, "sighting": 5, "kev": 0, "other": 62}}, "data": [{"timestamp": "2026-05-04T14:27:51.562Z", "date_only": false, "value": "2026-05-04T14:27:51.562Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-43871", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-24T23:09:35.274Z", "date_only": false, "value": "2026-07-24T23:09:35.274753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrghvod3i224", "record": "CVE-2026-43871", "field": "creation_timestamp", "uuid": "44d767eb-7dcf-416c-becb-d65bc8bfe4f4", "content": "CVE-2026-43871: Apache Thrift: TCompactProtocol varint byte-count limit", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrghvod3i224"}, {"timestamp": "2026-07-27T10:53:43.865Z", "date_only": false, "value": "2026-07-27T10:53:43.865000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-07-27T10:56:15.279Z", "date_only": false, "value": "2026-07-27T10:56:15.279Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-43871", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-27T10:56:15.279Z", "date_only": false, "value": "2026-07-27T10:56:15.279000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-07-27T10:56:15.279Z", "date_only": false, "value": "2026-07-27T10:56:15.279Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-43871", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-27T10:57:34.326Z", "date_only": false, "value": "2026-07-27T10:57:34.326000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-07-27T11:05:07.157Z", "date_only": false, "value": "2026-07-27T11:05:07.157000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-07-27T11:06:17.910Z", "date_only": false, "value": "2026-07-27T11:06:17.910000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-07-27T11:07:17.843Z", "date_only": false, "value": "2026-07-27T11:07:17.843Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-43871", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-27T11:09:41.544Z", "date_only": false, "value": "2026-07-27T11:09:41.544000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-07-27T11:11:23.201Z", "date_only": false, "value": "2026-07-27T11:11:23.201000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-07-27T11:12:40.875Z", "date_only": false, "value": "2026-07-27T11:12:40.875000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-07-27T11:18:49.830Z", "date_only": false, "value": "2026-07-27T11:18:49.830000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-07-27T12:01:15.066Z", "date_only": false, "value": "2026-07-27T12:01:15.066188+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-07-27T12:01:21.414Z", "date_only": false, "value": "2026-07-27T12:01:21.414479+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-07-27T12:01:25.459Z", "date_only": false, "value": "2026-07-27T12:01:25.459434+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-07-27T12:01:28.483Z", "date_only": false, "value": "2026-07-27T12:01:28.483023+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-07-27T12:01:31.554Z", "date_only": false, "value": "2026-07-27T12:01:31.554513+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-07-27T12:01:34.458Z", "date_only": false, "value": "2026-07-27T12:01:34.458030+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-07-27T12:01:38.876Z", "date_only": false, "value": "2026-07-27T12:01:38.876845+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-07-27T12:01:48.872Z", "date_only": false, "value": "2026-07-27T12:01:48.872068+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-07-27T12:01:58.342Z", "date_only": false, "value": "2026-07-27T12:01:58.342437+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-07-27T12:16:00Z", "date_only": false, "value": "2026-07-27T12:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-43871", "record": "UBUNTU-CVE-2026-43871", "field": "published"}, {"timestamp": "2026-07-27T12:16:44Z", "date_only": false, "value": "2026-07-27T12:16:44Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8WV5-X4W7-5GWW", "record": "GHSA-8WV5-X4W7-5GWW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-27T12:16:44.413Z", "date_only": false, "value": "2026-07-27T12:16:44.413", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-43871", "record": "FKIE_CVE-2026-43871", "field": "published"}, {"timestamp": "2026-07-27T12:31:16Z", "date_only": false, "value": "2026-07-27T12:31:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8WV5-X4W7-5GWW", "record": "GHSA-8WV5-X4W7-5GWW", "field": "published"}, {"timestamp": "2026-07-27T13:01:27.166Z", "date_only": false, "value": "2026-07-27T13:01:27.166234Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-43871", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-27T13:01:27.166Z", "date_only": false, "value": "2026-07-27T13:01:27.166234Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-43871", "record": "FKIE_CVE-2026-43871", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-27T13:01:39.993Z", "date_only": false, "value": "2026-07-27T13:01:39.993Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-43871", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-27T13:01:39.993Z", "date_only": false, "value": "2026-07-27T13:01:39.993Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-43871", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-27T19:51:36.197Z", "date_only": false, "value": "2026-07-27T19:51:36.197", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-43871", "record": "FKIE_CVE-2026-43871", "field": "lastModified"}, {"timestamp": "2026-07-28T09:08:10.313Z", "date_only": false, "value": "2026-07-28T09:08:10.313Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-THRIFT-2026-43871", "record": "BIT-THRIFT-2026-43871", "field": "published"}, {"timestamp": "2026-07-29T01:37:13.815Z", "date_only": false, "value": "2026-07-29T01:37:13.815570Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrqrz55jbh2s", "record": "CVE-2026-43871", "field": "creation_timestamp", "uuid": "046fd9d7-e4a2-4025-b53d-2ed004582d0c", "content": "\ud83d\udccc CVE-2026-43871 - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thri... https://www.cyberhub.blog/cves/CVE-2026-43871", "url": "https://bsky.app/profile/cyberhub.blog/post/3mrqrz55jbh2s"}, {"timestamp": "2026-08-01T00:00:00Z", "date_only": false, "value": "2026-08-01T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-01T00:00:00Z", "date_only": false, "value": "2026-08-01T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-08-01T00:00:00Z", "date_only": false, "value": "2026-08-01T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-01T00:00:00Z", "date_only": false, "value": "2026-08-01T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-08-03T23:43:03Z", "date_only": false, "value": "2026-08-03T23:43:03+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-03T23:43:03Z", "date_only": false, "value": "2026-08-03T23:43:03+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-08-03T23:43:03Z", "date_only": false, "value": "2026-08-03T23:43:03+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-08-07T01:21:56Z", "date_only": false, "value": "2026-08-07T01:21:56.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-07T01:21:56Z", "date_only": false, "value": "2026-08-07T01:21:56.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-08-07T01:21:56Z", "date_only": false, "value": "2026-08-07T01:21:56.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-08-11T01:03:59Z", "date_only": false, "value": "2026-08-11T01:03:59.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-08-23T14:59:11Z", "date_only": false, "value": "2026-08-23T14:59:11.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-08-23T14:59:11Z", "date_only": false, "value": "2026-08-23T14:59:11.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-08-24T07:04:20.156Z", "date_only": false, "value": "2026-08-24T07:04:20.156Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-43871", "record": "MSRC_CVE-2026-43871", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-27T11:48:03.261Z", "date_only": false, "value": "2026-08-27T11:48:03.261296Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/prajnak/06b8b2c74ce416478b826c460d0061f8", "record": "CVE-2026-43871", "field": "creation_timestamp", "uuid": "2b7a22c0-06d2-4b51-983d-0a76ece5871c", "content": "# Apache Thrift 2026 CVEs are invisible to purl-matching SCA\n\n**TL;DR** \u2014 The August 2026 Apache Thrift advisories (fixed in `0.24.0`) carry\n**CPE identifiers only**. No `pkg:pypi` / `pkg:maven` purl is ever produced, so any\nSCA that matches code libraries by ecosystem+purl finds nothing to attach them to.\nAn image with `thrift==0.22.0` installed from PyPI scans **clean**.\n\nThis is reproducible in two `curl` calls against public APIs \u2014 no scanner licence,\nno private data.\n\n---\n\n## Reproduce in 30 seconds (no Docker needed)\n\n### 1. Ask OSV whether PyPI `thrift` 0.22.0 has known vulnerabilities\n\n```bash\ncurl -s -X POST https://api.osv.dev/v1/query \\\n  -d '{\"package\":{\"name\":\"thrift\",\"ecosystem\":\"PyPI\"},\"version\":\"0.22.0\"}'\n```\n\n```json\n{}\n```\n\nEmpty. Zero vulnerabilities.\n\n### 2. Now confirm the advisory exists \u2014 and explicitly names Python\n\n```bash\ncurl -s https://api.osv.dev/v1/vulns/CVE-2026-41608 | jq '{id, summary}'\n```\n\n```json\n{\n  \"id\": \"CVE-2026-41608\",\n  \"summary\": \"Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport\"\n}\n```\n\nThe advisory exists. Its own summary says **Python**. `0.22.0` is in range\n(fixed in `0.24.0`). Yet step 1 returns nothing.\n\n---\n\n## Root cause\n\n```bash\ncurl -s https://api.osv.dev/v1/vulns/CVE-2026-41608 | jq '.affected[0]'\n```\n\n```json\n{\n  \"ranges\": [\n    {\n      \"type\": \"GIT\",\n      \"repo\": \"https://github.com/apache/thrift\",\n      \"events\": [\n        { \"introduced\": \"0\" },\n        { \"fixed\": \"6d2ec95f450b4ce404afb8929ff479e68770141a\" }\n      ],\n      \"database_specific\": {\n        \"cpe\": \"cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*\",\n        \"extracted_events\": [\n          { \"introduced\": \"0\" },\n          { \"fixed\": \"0.24.0\" }\n        ],\n        \"source\": \"CPE_RANGE\"\n      }\n    }\n  ],\n  \"versions\": [\"last-before-0-10\"]\n}\n```\n\nThree things to notice:\n\n1. **There is no `package` key.** No ecosystem, no name, no purl. A purl-matching\n   engine has nothing to key on.\n2. `ranges[0].type` is **`GIT`**, not `ECOSYSTEM` \u2014 the range is a commit SHA,\n   auto-derived from a CPE (`\"source\": \"CPE_RANGE\"`).\n3. `versions` is `[\"last-before-0-10\"]` \u2014 a placeholder artifact of that\n   conversion, not a usable version list.\n\nThe upstream advisory was filed against the Apache Thrift *product* via CPE.\nNothing downstream ever binds it to `pkg:pypi/thrift`, `pkg:maven/org.apache.thrift/libthrift`,\n`pkg:npm/thrift`, or any other ecosystem package.\n\n---\n\n## Reproduce against a container image\n\n```dockerfile\n# Dockerfile\nFROM python:3.12-slim\nRUN pip install --no-cache-dir thrift==0.22.0\n```\n\n```bash\ndocker build -t thrift-cve-repro:0.22.0 .\n```\n\nConfirm the package and its metadata are present and discoverable:\n\n```bash\ndocker run --rm thrift-cve-repro:0.22.0 \\\n  sh -c 'pip show thrift | head -2; ls /usr/local/lib/python3.12/site-packages | grep -i thrift'\n```\n\n```\nName: thrift\nVersion: 0.22.0\nthrift\nthrift-0.22.0.dist-info\n```\n\nNow scan that image with any purl-matching SCA.\n\n**Expected:** at least CVE-2026-41608, CVE-2026-48586, CVE-2026-43871 reported,\nfixed in `0.24.0`.\n\n**Actual:** zero findings for `thrift`. The SBOM correctly lists\n`thrift 0.22.0 (PyPI)` \u2014 discovery works fine. Only *matching* fails.\n\n---\n\n## Which advisories actually apply to a Python deployment\n\nApache Thrift published 18 advisories fixed in `0.24.0`. **Only three name the\nPython bindings.** These are the ones a PyPI `thrift` install is exposed to:\n\n| CVE | Bindings named in the advisory | CVSS |\n|---|---|---|\n| CVE-2026-41608 | **Python** only | 7.5 |\n| CVE-2026-48586 | C++, Java, **Python**, Go, D, C/GLib | 7.5 |\n| CVE-2026-43871 | **Python**, Go, PHP, Java | 7.5 |\n\nAll three: `AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H` \u2014 remote unauthenticated\ndenial of service against anything deserializing untrusted Thrift payloads.\n\nThe other 15 do **not** apply to a Python deployment. They are C++, c_glib,\nSwift, Rust, Node.js, Go and Java binding bugs \u2014 `TSSLSocket::matchName`,\n`web_server.js`, `TFramedTransport` uint32 overflow, and similar. None of that\ncode ships in the PyPI package.\n\nVerify any of them yourself:\n\n```bash\nfor c in CVE-2026-55971 CVE-2026-58023 CVE-2026-41604 CVE-2026-41602; do\n  curl -s \"https://api.osv.dev/v1/vulns/$c\" | jq -r '\"\\(.id)  \\(.summary)\"'\ndone\n```\n\n```\nCVE-2026-55971  Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()\nCVE-2026-58023  Apache Thrift: c_glib heap out-of-bounds read in transport\nCVE-2026-41604  Apache Thrift: Swift Range crash in skip()\nCVE-2026-41602  Apache Thrift: Go TFramedTransport uint32 overflow\n```\n\n---\n\n## What a fix should look like\n\nAdd ecosystem/purl mappings **per binding**, driven by the bindings each advisory\nnames in its own text:\n\n```\nCVE-2026-41608  ->  pkg:pypi/thrift                         (< 0.24.0)\nCVE-2026-48586  ->  pkg:pypi/thrift, pkg:maven/org.apache.thrift/libthrift, ...\nCVE-2026-43871  ->  pkg:pypi/thrift, pkg:maven/..., pkg:composer/...\n```\n\n## What a fix should **not** look like\n\nDo not blanket-CPE-match ecosystem packages against `cpe:2.3:a:apache:thrift`.\n\nA scanner that does this reports **all 18** against `thrift 0.22.0`, including\n~14 rated Critical \u2014 because it inherits per-binding CVSS scores from bindings\nthat aren't installed. That is roughly **5\u00d7 over-reported** for a Python\ndeployment, and triaging it back down to the real three costs more time than the\noriginal finding saved.\n\nThe gap here is precision *and* recall: three real findings are missed, and the\nnaive fix would introduce fifteen false ones.\n\n---\n\n## Wider question\n\nApache Thrift is unlikely to be unique. The pattern is: **one upstream project,\nmany language bindings, advisories filed at product level with CPE only**.\nOther multi-binding projects (protobuf, gRPC, Avro, Arrow, ICU, libxml2\nwrappers) plausibly share it.\n\nTwo things that would help anyone consuming this data:\n\n1. A way to report on SBOM components whose only matching advisories are\n   CPE-only \u2014 i.e. *where am I blind right now?*\n2. Systematic per-binding purl mapping where an advisory's text names the\n   affected bindings, rather than case-by-case backfill.\n\n---\n\n*Verified 2026-08-27 against `api.osv.dev`. Everything above uses public APIs and\npublic package data; no scanner output or private environment data is included.*\n", "url": "https://gist.github.com/prajnak/06b8b2c74ce416478b826c460d0061f8"}, {"timestamp": "2026-09-02T14:31:01Z", "date_only": false, "value": "2026-09-02T14:31:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8WV5-X4W7-5GWW", "record": "GHSA-8WV5-X4W7-5GWW", "field": "modified"}, {"timestamp": "2026-09-03T08:57:56Z", "date_only": false, "value": "2026-09-03T08:57:56Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-EVERNOTE-BACKUP-CVE-2026-43871", "record": "BREW-EVERNOTE-BACKUP-CVE-2026-43871", "field": "published"}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-THRIFT-2026-43871", "record": "BIT-THRIFT-2026-43871", "field": "modified"}, {"timestamp": "2026-09-08T14:32:32Z", "date_only": false, "value": "2026-09-08T14:32:32+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-10T02:43:42.648Z", "date_only": false, "value": "2026-09-10T02:43:42.648597Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-TY53144", "record": "CLEANSTART-2026-TY53144", "field": "published"}, {"timestamp": "2026-09-10T09:44:50.953Z", "date_only": false, "value": "2026-09-10T09:44:50.953288Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-3926", "record": "PYSEC-2026-3926", "field": "published"}, {"timestamp": "2026-09-10T11:02:33.912Z", "date_only": false, "value": "2026-09-10T11:02:33.912636Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-3926", "record": "PYSEC-2026-3926", "field": "modified"}, {"timestamp": "2026-09-16T20:22:02Z", "date_only": false, "value": "2026-09-16T20:22:02Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-16T21:24:44Z", "date_only": false, "value": "2026-09-16T21:24:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-17T17:17:49Z", "date_only": false, "value": "2026-09-17T17:17:49Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-09-17T17:17:49Z", "date_only": false, "value": "2026-09-17T17:17:49Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11432-1", "record": "OPENSUSE-SU-2026:11432-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-18T01:30:00.429Z", "date_only": false, "value": "2026-09-18T01:30:00.429155Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-KQ31223", "record": "CLEANSTART-2026-KQ31223", "field": "published"}, {"timestamp": "2026-09-18T09:24:51.968Z", "date_only": false, "value": "2026-09-18T09:24:51.968877Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-MY58783", "record": "CLEANSTART-2026-MY58783", "field": "published"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-KQ31223", "record": "CLEANSTART-2026-KQ31223", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-TY53144", "record": "CLEANSTART-2026-TY53144", "field": "modified"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-KQ31223", "record": "CLEANSTART-2026-KQ31223", "field": "withdrawn"}, {"timestamp": "2026-09-18T11:59:01.768Z", "date_only": false, "value": "2026-09-18T11:59:01.768079Z", "kind": "other", "label": "Withdrawn", "source": "cleanstart \u00b7 CLEANSTART-2026-TY53144", "record": "CLEANSTART-2026-TY53144", "field": "withdrawn"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": true, "value": "2026-09-25", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-25T05:40:14.490Z", "date_only": false, "value": "2026-09-25T05:40:14.490222Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5372l2h", "record": "CVE-2026-43871", "field": "creation_timestamp", "uuid": "e9a01e70-b620-49bf-a9c0-a389cbc3362a", "content": "CVE-2026-56819 CVE-2026-59889 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 GHSA-mhm7-754m-9p8w N/A Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerabilities: CVE-2026-43871", "url": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5372l2h"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": true, "value": "2026-09-28", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-09-29T00:35:00.837Z", "date_only": false, "value": "2026-09-29T00:35:00.837416Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-IT04262", "record": "CLEANSTART-2026-IT04262", "field": "published"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "vendor_advisories.3.published_at"}, {"timestamp": "2026-09-30T00:35:58.836Z", "date_only": false, "value": "2026-09-30T00:35:58.836140Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-AP36720", "record": "CLEANSTART-2026-AP36720", "field": "published"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "last_revision_date"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "initial_release_date"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1256", "record": "CERTFR-2026-AVI-1256", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-06T00:36:19.652Z", "date_only": false, "value": "2026-10-06T00:36:19.652142Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-BM76577", "record": "CLEANSTART-2026-BM76577", "field": "published"}, {"timestamp": "2026-10-07T22:52:10Z", "date_only": false, "value": "2026-10-07T22:52:10Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-EVERNOTE-BACKUP-CVE-2026-43871", "record": "BREW-EVERNOTE-BACKUP-CVE-2026-43871", "field": "modified"}, {"timestamp": "2026-10-08T04:20:12.026Z", "date_only": false, "value": "2026-10-08T04:20:12.026095Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mxdm7zjgtl2x", "record": "CVE-2026-43871", "field": "creation_timestamp", "uuid": "96bc8b2f-097c-4540-9334-1277af217731", "content": "This addresses the following vulnerabilities: CVE-2026-43871 CVE-2026-81870 CVE-2026-81871 CVE-2026-81872 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 N/A Security fixes for apigee-operators", "url": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mxdm7zjgtl2x"}, {"timestamp": "2026-10-08T14:25:20Z", "date_only": false, "value": "2026-10-08T14:25:20Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-AP36720", "record": "CLEANSTART-2026-AP36720", "field": "modified"}, {"timestamp": "2026-10-08T15:17:47Z", "date_only": false, "value": "2026-10-08T15:17:47Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-BM76577", "record": "CLEANSTART-2026-BM76577", "field": "modified"}, {"timestamp": "2026-10-08T15:57:36Z", "date_only": false, "value": "2026-10-08T15:57:36Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-IT04262", "record": "CLEANSTART-2026-IT04262", "field": "modified"}, {"timestamp": "2026-10-09T03:56:14Z", "date_only": false, "value": "2026-10-09T03:56:14Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-MY58783", "record": "CLEANSTART-2026-MY58783", "field": "modified"}, {"timestamp": "2026-10-14T12:16:46Z", "date_only": false, "value": "2026-10-14T12:16:46Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-GN57450", "record": "CLEANSTART-2026-GN57450", "field": "modified"}, {"timestamp": "2026-10-15T00:39:07.448Z", "date_only": false, "value": "2026-10-15T00:39:07.448962Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-GN57450", "record": "CLEANSTART-2026-GN57450", "field": "published"}, {"timestamp": "2026-10-16T04:01:58Z", "date_only": false, "value": "2026-10-16T04:01:58+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-16T04:01:58Z", "date_only": false, "value": "2026-10-16T04:01:58+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-16T04:01:58Z", "date_only": false, "value": "2026-10-16T04:01:58+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:49837", "record": "RHSA-2026:49837", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-17T09:42:29Z", "date_only": false, "value": "2026-10-17T09:42:29Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-43871", "record": "UBUNTU-CVE-2026-43871", "field": "modified"}, {"timestamp": "2026-10-21T11:17:40Z", "date_only": false, "value": "2026-10-21T11:17:40Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-YY80093", "record": "CLEANSTART-2026-YY80093", "field": "modified"}, {"timestamp": "2026-10-22T00:37:01.983Z", "date_only": false, "value": "2026-10-22T00:37:01.983512Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-YY80093", "record": "CLEANSTART-2026-YY80093", "field": "published"}]}