Skip to content

NVD provider ignores the package data Apache and other reporters supply #1296

Description

@carlosfunk

What would you like to be added:

Each CVE from the NVD API has two descriptions of what's affected: cve.configurations[], which lists CPEs, and cve.affected[], which is what the reporting organisation wrote. Vunnel only reads the first one, so the second gets downloaded and thrown away.

The second one is often better. It says which package manager and which package name, so it can be matched by name instead of guessing at CPE strings.

Why is this needed:

Apache published a batch of Thrift CVEs in July 2026 and scanning with grype missed them all. They were then later picked up by a third party using twistlock.

All of these contain enough info to match to thrift/pypi:

CVE-2026-41608 - Highly compressed data can be used to exhaust memory
CVE-2026-43871 - Malformed input can cause an infinite loop
CVE-2026-48586 - Highly compressed data can be used to exhaust memory
CVE-2026-66053 - TLS certificate hostnames aren't checked.

There was no GitHub or OSV advisory for this package, so name matching finds nothing. CPE matching doesn't work either: NVD files it under cpe:2.3:a:apache:thrift, but syft builds apache_thrift_developers:thrift, thrift:thrift, python:thrift and 18 more, never apache:thrift. Turning on match.python.using-cpes still finds nothing.

(I've manually gone and updated the GHSA for each of these now)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

  • Status
    In Progress

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions