Why CVE records change

CVE IDs are the backbone of public vulnerability tracking, but the record attached to an ID isn’t necessarily perfect at publication. If you maintain or depend on software with a CVE record that’s missing details, contains inaccuracies, or lacks references, you can request a correction. The route to doing so runs through the CVE Numbering Authority (CNA) that issued the CVE, not through intermediate databases. GitHub is one of more than 400 CNAs and supports community-driven corrections to records it has issued. The same process works for any CNA.

Identify the issuing CNA

The first step is reading the CVE record itself. Every CVE record names the CNA that issued the CVE ID, and that CNA is the only party authorized to update the record after initial publication.

On cve.org, the CNA appears as the first data point under the “Required CVE Record Information” header and is also displayed on the right side of the page.

A screenshot of the cve.org record for CVE-2023-29012, with a yellow rectangle drawn around the “CNA” field to draw attention to the fact that “GitHub (Maintainer Security Advisories)” is the CNA for CVE-2023-29012.

On nvd.nist.gov, the same information is in the “QUICK INFO” box, labeled as “Source.”

A screenshot of the nist.nvd.gov record for CVE-2023-29012, with a yellow rectangle drawn around the “Source” field to draw attention to the fact that “GitHub, Inc.” is the CNA for CVE-2023-29012.

Locate the CNA’s contact channel

Once you know the CNA, find its official contact details on the CVE Program’s partner list at https://www.cve.org/PartnerInformation/ListofPartners. Use the search bar to find the organization, and confirm you’ve selected the correct CNA if an organization runs more than one. The partner list entry links to a profile page that includes the CNA’s scope and contact information.

A screenshot of the cve.org “List of Partners.” The “Search” bar shows “GitHub,” being searched for, with two results of the search shown under the search bar. Those results are “GitHub, Inc.,” the CNA that matches the CNA responsible for CVE-2023-29012, and “GitHub, Inc. (Products Only),” a different CNA that GitHub also operates.

For most CNAs, the preferred contact method is email. On the partner profile page, use the link under “Step 2: Contact” labelled Email to get the address.

A screenshot of the cve.org entry for the CNA “GitHub, Inc.” A yellow rectangle is drawn around a header and a link. The header reads “Step 2: Contact” and shows a link that says “Email” directly below the header.

MITRE — the largest CNA by volume — is the notable exception. It takes requests through a webform at https://cveform.mitre.org/ rather than email. That form covers requests to create, update, dispute, or reject CVE records.

What to put in your request

Your message to the CNA should cover four essentials:

  • The CVE ID in question
  • The exact information you want added, removed, or changed
  • The reasoning behind the change
  • Supporting evidence, ideally a public reference link

Reference links matter because they give the CNA a verifiable basis for the edit. Useful references include:

  • A public vulnerability report, advisory, or proof-of-concept
  • A fix commit or release notes describing the patch
  • An issue in the affected repository where the maintainer discusses the vulnerability
  • A community contribution pull request that proposes a change to the CVE’s corresponding GitHub Security Advisory

Remember that the CNA isn’t the only reader. Well-documented context about disclosure decisions and vulnerability details helps the broader developer and security community assess risk and choose mitigations.

Response time and what happens if it stalls

CNA response times vary. The CVE CNA rules (sections 3.2.4.1 and 3.2.4.2) require CNAs to respond “in a timely manner” to ID assignment requests submitted through the public point of contact, but do not set a timeline for responding to requests to change existing records. Distinct rules under sections 4.2 and 4.5 do set a 72-hour limit for assigning IDs or publishing records for publicly-known vulnerabilities — that guidance doesn’t extend to modifications.

If a CNA doesn’t respond or you disagree with its decision, the CVE Program’s dispute procedure is the escalation path. The CVE Record Dispute Policy spells out how to initiate and escalate a dispute. In that scenario, it helps to know the CNA’s top-level root organization, which oversees the dispute review. You can find that on the CNA’s partner profile page under the “Top-Level Root” column; for most CNAs it’s MITRE.

A screenshot of the cve.org entry for the CNA “GitHub, Inc.” A yellow rectangle is drawn around an entry in a table to draw attention to the two items in the table that are being discussed in the post. The left column contains the category “Top-Level Root,” and the right column contains the entry “MITRE Corporation,” with the text containing a link to a page about the MITRE Corporation.

If a CVE record has an accompanying GitHub Security Advisory, you can improve both in parallel. The GitHub Advisory Database accepts community contributions for editing security advisories directly.