Significant Delay in CVE ID Assignment for Published Security Advisory (Pending 7+ Days)

[5H4D0WBY73]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Discussion Details

Hi everyone,

I am looking for assistance from the GitHub CNA team regarding a public vulnerability advisory that is currently awaiting its CVE identifier.

I reported a vulnerability to an open-source project, and the maintainer officially published the advisory 16 hours ago.

• Advisory Link: GHSA-4wqh-7f4f-5qmx

An initial CVE request was made a week ago while private, and a subsequent action/advisory publication occurred 16 hours ago. The page currently shows "No known CVE" because the identifier has not yet been assigned by the system.

Since this flaw is now fully disclosed to the public, having the CVE ID assigned quickly is vital so that security firewalls and vulnerability scanners can properly index the patch for users.

Could a GitHub staff member please verify if this request is successfully sitting in the public curation queue?

Thank you!

[studioframes]

Hi @5H4D0WBY73,

It is completely normal for a newly published GHSA (GitHub Security Advisory) to show "No known CVE" for a brief period right after it goes public!

When a maintainer publishes a private advisory that was assigned to GitHub as the CVE Numbering Authority (CNA), the CVE assignment and sync process usually takes a little bit of time to flow through the pipeline.

What’s Happening Behind the Scenes

1. The Curation Queue: Once published, GHSA advisories enter GitHub's internal database curation queue. GitHub's security team reviews the details before formally requesting or reserving the CVE ID from the MITRE / NVD pipeline.
2. Standard Processing Window: While automated tools index GHSAs almost instantly via the GHSA-... identifier, assigning the formal CVE-YYYY-XXXXX ID typically takes anywhere from 24 to 72 business hours depending on queue volume.
3. Upstream NVD Delay: Once GitHub assigns the CVE ID, syncing with the National Vulnerability Database (NVD) can take additional time for downstream scanners (like Snyk, Trivy, or commercial firewalls) to pick up the CVE record.

Key Things to Keep in Mind

• The GHSA Identifier is Active: Security scanners that consume the GitHub Advisory Database API (including GitHub Dependabot and many modern open-source scanners) can already track and alert on the vulnerability using the GHSA-4wqh-7f4f-5qmx ID, even before the CVE string finishes populating.
• No Direct Escalation via Community: GitHub staff do not manually assign CVE IDs or pull advisories out of the queue based on forum posts. The CNA review queue runs as an automated background workflow.

If the advisory remains without a CVE ID after 3 to 5 business days, the maintainer of the repository can open a support request via the GitHub Security & Bug Bounty / CNA Support portal to check on the pipeline status.

For now, rest assured that the public GHSA identifier is live and serving its purpose!

[avishaigonen-pluto]

Hey, I've reported multiple reports through PVR. They got published and also have been requested for a CVE. Most of them are already waiting for above a month... Is that normal?

GHSA-9x8x-crjq-g64h
GHSA-24pw-rf5p-mgp7
GHSA-2cwc-6wwp-62q6
GHSA-833v-v58w-294h
GHSA-5gm3-9crp-6g3v

[Char0n1507]

Same here @avishaigonen-pluto I have submitted multiple a month ago even I am still waiting.!