CVE not assigned for 24 days?

[degenaro]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Discussion Details

Out project has draft security advisories for which CVEs were requested as long as 24 days ago. If it's no longer true that the "process may take up to 3 working days", can that be updated to reflect the time expected for review and assignment to be more accurate? Can you verify that we have 3 CVEs in queue for compliance-trestle? Thx.

[justin24er]

Ok!, 24 days is well beyond the stated "up to 3 working days" window, so this is worth flagging directly rather than assuming it's just a busy queue, that SLA is documented as the norm, not a best-case.

A couple of practical notes:

• GitHub's CVE request queue (as a CNA) can genuinely back up during high-volume periods, but 3+ weeks with zero movement usually means something's stuck, not just slow, worth checking your draft advisories for any pending action needed on your end (sometimes a CVE request stalls silently if additional info was requested and missed).

• Only GitHub staff can actually verify queue status for specific repos like compliance-trestle, community can't look that up, so this needs to go through GitHub Support rather than Discussions for a real answer.

When you file it, reference the specific advisory IDs/draft URLs and the exact request dates, that gives them something concrete to trace rather than a general "queue is slow" report, and mention the doc's 3-day claim directly since that's a fair ask for them to either honor or correct.

[degenaro]

I'm not sure where to look for pending action required. Here is all that I see: degenaro requested a CVE 3 weeks ago.

I will file an issue with GitHub Support as you suggest.

[justin24er]

Sounds good, that's the right move! Since 3 weeks with zero movement and no visible pending action on your end, this really does need a human to check the internal queue directly. Hope it gets sorted quickly for you 🤞 Good luck!

[wu21-web]

I met the same situation, I have been waiting for over a week, which is very slow for security responses.