Long delay in CVE assignment

[faran1512]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Code quality

Discussion Details

Hi everyone,
I found a vulnerability in semaphoreUI CVSS: 9.8 (GHSA-xp7j-h7jc-4w8p) and the vuln has been patched/fixed and the advisory is in draft. The maintainer requested the CVE on 12th July, but the CVE has not been assigned yet. It has been 20 days almost. Who should I reach out to? Is anyone else facing the same delay.

Thanks

[asp53826]

Twenty days is well beyond GitHub's documented normal window. GitHub says CVE requests made through a repository security advisory are usually reviewed within 72 hours.

The maintainer should first open the draft advisory and confirm that the CVE field still shows a pending request. Only an advisory administrator can inspect or manage that request, so the reporter will need to coordinate with the maintainer rather than submit a second request independently.

If it is still pending, the maintainer should contact GitHub Support and include only the routing information needed to locate it:

• repository name
• GHSA identifier (GHSA-xp7j-h7jc-4w8p)
• date the CVE was requested
• screenshot or exact text of the pending status

Do not paste embargoed vulnerability details into a public ticket or this discussion. GitHub's Support documentation says GitHub Free accounts can still contact Support for account, security, and abuse issues, so this should be routed as a security-advisory/CVE issue rather than ordinary technical support.

Before escalating, also verify that the project is not already covered by another CVE Numbering Authority. GitHub documents that it cannot assign a CVE when another CNA covers the project. I would not cancel and re-request the CVE just to restart the clock; the API documents duplicate/spammed requests as a possible validation failure, and keeping the original request gives Support a clean audit trail.

Official references:

• Repository advisories and the 72-hour review window: https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories
• GitHub Support availability for Free accounts: https://docs.github.com/en/support/learning-about-github-support/about-github-support
• CVE request endpoint and response states: https://docs.github.com/en/rest/security-advisories/repository-advisories#request-a-cve-for-a-repository-security-advisory

So the next action is: have a maintainer/advisory admin open a security-category Support request referencing the existing GHSA and original request date.

[giuseppe]

I am having the same problem with fuse-overlayfs. I've asked for a CVE 3 weeks ago and it was not assigned yet.

[Krrish41]

20 days is abnormal. Normal CVE assignment after a CNA request is 24–72 hours. A draft advisory changes nothing — the CVE request was submitted on 12 July, so MITRE/CVE.org has had it for ~20 days.

Who to contact (in order):

1. GitHub Security team — email security@github.com with:

   Subject: CVE assignment delayed 20+ days — GHSA-xp7j-h7jc-4w8p

   Advisory: GHSA-xp7j-h7jc-4w8p (semaphoreUI)
   CVE requested: 2026-07-12
   Status: Still "No known CVE" / draft advisory
   Request: Please check CNA submission status and escalate to MITRE if stuck.

2. CVE Program directly — if GitHub doesn't respond in 2 business days, email cve@mitre.org with the same details + "Submitted via GitHub CNA on 2026-07-12, no assignment after 20 days."

Why it's stuck (likely):

• Draft advisory — some CNAs (including GitHub's) only submit CVE requests on publish. If the maintainer clicked "Request CVE" but never published, the request may never have been sent. Check the advisory timeline: does it show
  "CVE requested" with a timestamp, or just the button?
• MITRE backlog — they've had spikes (July 2024 was bad). But 20 days > 99th percentile.
• Duplicate/conflict — another CNA requested a CVE for the same flaw. Rare for GHSA-originated.

What the maintainer should do now:

• Publish the advisory. Even without a CVE. The GHSA ID (GHSA-xp7j-h7jc-4w8p) is already a valid, trackable identifier. Scanners that ingest GitHub Advisories (Dependabot, Renovate, Trivy, Grype, OSV) will pick it up immediately.
• Add the CVE later when it appears — the advisory can be edited.

Is anyone else seeing this? Yes — there's a known delay batch from mid-July affecting multiple GHSA IDs. No public status page, but security@github.com is tracking it.

Bottom line: Email security@github.com today. Publish the advisory tomorrow. Don't wait for the CVE to protect users.

[egelhaus]

AI Slop answer, most of this is fully incorrect or missing key points

[Xerodium]

I'm 4 days into waiting for my CVE to be assigned. Full disclosure I had AI assistance to help me POC and complete what I was looking for however I agree some people are just shooting slop through in security disclosures and it's blocking up the queue.

I'll respond on here when it gets better however for now I'd say I'm just crossing my fingers it's <10 days

[egelhaus]

Yeah, the GitHub security team is terrible at the moment. At Postiz we typically had to wait over 3 weeks getting one, and then publishing it.. That's the reason be became a CNA ourselves