What would you like to be added:
Each CVE from the NVD API has two descriptions of what's affected: cve.configurations[], which lists CPEs, and cve.affected[], which is what the reporting organisation wrote. Vunnel only reads the first one, so the second gets downloaded and thrown away.
The second one is often better. It says which package manager and which package name, so it can be matched by name instead of guessing at CPE strings.
Why is this needed:
Apache published a batch of Thrift CVEs in July 2026 and scanning with grype missed them all. They were then later picked up by a third party using twistlock.
All of these contain enough info to match to thrift/pypi:
CVE-2026-41608 - Highly compressed data can be used to exhaust memory
CVE-2026-43871 - Malformed input can cause an infinite loop
CVE-2026-48586 - Highly compressed data can be used to exhaust memory
CVE-2026-66053 - TLS certificate hostnames aren't checked.
There was no GitHub or OSV advisory for this package, so name matching finds nothing. CPE matching doesn't work either: NVD files it under cpe:2.3:a:apache:thrift, but syft builds apache_thrift_developers:thrift, thrift:thrift, python:thrift and 18 more, never apache:thrift. Turning on match.python.using-cpes still finds nothing.
(I've manually gone and updated the GHSA for each of these now)
What would you like to be added:
Each CVE from the NVD API has two descriptions of what's affected:
cve.configurations[], which lists CPEs, andcve.affected[], which is what the reporting organisation wrote. Vunnel only reads the first one, so the second gets downloaded and thrown away.The second one is often better. It says which package manager and which package name, so it can be matched by name instead of guessing at CPE strings.
Why is this needed:
Apache published a batch of Thrift CVEs in July 2026 and scanning with grype missed them all. They were then later picked up by a third party using twistlock.
All of these contain enough info to match to thrift/pypi:
CVE-2026-41608 - Highly compressed data can be used to exhaust memory
CVE-2026-43871 - Malformed input can cause an infinite loop
CVE-2026-48586 - Highly compressed data can be used to exhaust memory
CVE-2026-66053 - TLS certificate hostnames aren't checked.
There was no GitHub or OSV advisory for this package, so name matching finds nothing. CPE matching doesn't work either: NVD files it under cpe:2.3:a:apache:thrift, but syft builds apache_thrift_developers:thrift, thrift:thrift, python:thrift and 18 more, never apache:thrift. Turning on match.python.using-cpes still finds nothing.
(I've manually gone and updated the GHSA for each of these now)