{"id":86286,"date":"2025-04-09T13:02:44","date_gmt":"2025-04-09T20:02:44","guid":{"rendered":"https:\/\/github.blog\/?p=86286"},"modified":"2025-04-09T13:02:44","modified_gmt":"2025-04-09T20:02:44","slug":"how-to-request-a-change-to-a-cve-record","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/vulnerability-research\/how-to-request-a-change-to-a-cve-record\/","title":{"rendered":"How to request a change to a CVE record"},"content":{"rendered":"\n

Ever come across a Common Vulnerabilities and Exposures (CVE) ID<\/a> affecting software you use or maintain and thought the information could be better?<\/p>\n

CVE IDs are a widely-used system for tracking software vulnerabilities. When a vulnerable dependency affects your software, you can create a repository security advisory<\/a> to alert others. But if you want your insight to reach the most upstream data source possible, you’ll need to contact the CVE Numbering Authority (CNA) that issued the vulnerability’s CVE ID.<\/p>\n

GitHub, as part of a community of over 400 CNAs<\/a>, can help in cases when GitHub issued the CVE (such as with this community contribution<\/a>). And with just a few key details, you can identify the right CNA and reach out with the necessary context. This guide shows you how.<\/p>\n

Step 1: Find the CNA that issued the CVE<\/span><\/a><\/h2>\n

Every CVE record contains an entry that includes the name of the CNA that issued the CVE ID. The CNA is responsible for updating the CVE record after its initial publication, so any requests should be directed to them.<\/p>\n

On cve.org<\/a>, the CNA is listed as the first piece of information under the “Required CVE Record Information” header. The information is also available on the right side of the page.<\/p>\n

\"A<\/p>\n

On nvd.nist.gov<\/a>, information about the issuing CNA is available in the “QUICK INFO” box. The issuing CNA is called “Source”.<\/p>\n

\"A<\/p>\n

Step 2: Find the contact information for the CNA<\/span><\/a><\/h2>\n

After identifying the CNA from the CVE record, locate their official contact information to request updates or changes. That information is available on the CNA partners website at https:\/\/www.cve.org\/PartnerInformation\/ListofPartners<\/a>.<\/p>\n

Search for the CNA’s name in the search bar. Some organizations may have more than one CNA, so make sure that the CVE you want corresponds to the correct CNA.<\/p>\n

\"A<\/p>\n

The left column, under “Partner,” has the name of the CNA that links to a profile page with its scope and contact information.<\/p>\n

Step 3: Contact the CNA<\/span><\/a><\/h2>\n

Most CNAs have an email address for CVE-related communications. Click the link under “Step 2: Contact” that says Email<\/strong> to find the CNA’s email address.<\/p>\n

\"A<\/p>\n

The most notable exception to the general preference for email communication among CNAs is the MITRE Corporation<\/a>, the world’s most prolific CVE Numbering Authority. MITRE uses a webform at https:\/\/cveform.mitre.org\/<\/a> for submitting requests to create, update, dispute, or reject CVEs.<\/p>\n

What to include in your communication to the CNA<\/span><\/a><\/h2>\n