Multiple published GitHub Security Advisories remain "No known CVE" after maintainers requested CVEs

[Tike00]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Code quality

Discussion Details

Multiple published GitHub Security Advisories remain "No known CVE" after maintainers requested CVEs

Hi GitHub team and the security community,

I'm an independent security researcher who regularly reports vulnerabilities to open source projects through GitHub Security Advisories.

Over the past few months, I've noticed the same behavior across multiple unrelated repositories, and I'm hoping to understand whether this is expected or if there is something I'm missing.

Situation

For each advisory below:

• The vulnerability report was accepted by the project.
• The maintainer created a GitHub Security Advisory.
• The advisory was published.
• The maintainer explicitly requested a CVE through GitHub.
• However, the advisory still displays "No known CVE" after a considerable amount of time.

Examples

Project	GHSA
Kurrier	GHSA-jwj6-pxj6-9q8g
Transmute	GHSA-gp9p-77f3-j7g5
Paca	GHSA-xwmv-9c7h-g947
Tunarr	GHSA-hm4x-5g5j-jjhq
OpenChoreo	GHSA-46r4-q7wv-32fc
Borg UI	GHSA-qmvm-37wj-2v72
Bulwark Webmail	GHSA-24w9-8r42-8jwm
Tandoor Recipes	GHSA-gh65-4455-65vg

These advisories belong to different organizations, maintainers, repositories, and vulnerability types, yet all appear in the same state.

For example, one advisory's timeline shows:

• Report accepted
• Maintainer requested a CVE
• Advisory published
• Current status: "No known CVE"

The other advisories follow essentially the same pattern.

My Questions

I'm not requesting expedited processing, and I completely understand that GitHub CNA may experience review backlogs.

I'm mainly trying to understand the current state of these requests.

Specifically:

1. Is there currently a known backlog affecting GitHub CNA CVE assignments?
2. Is it normal for a published advisory to remain in the "No known CVE" state for several weeks or even months after a maintainer has requested a CVE?
3. As the vulnerability reporter (rather than the maintainer), is there any way for me to determine whether these requests are still in the GitHub CNA review queue?
4. Does this state generally mean the requests are still pending review, or could it indicate that additional action is required from the repository maintainers?
5. Would GitHub recommend that maintainers open individual Support tickets for each advisory, or is simply waiting the appropriate approach?

Why I'm Asking

These advisories represent a significant portion of my publicly disclosed security research.

The associated CVE IDs are important not only for vulnerability tracking, but also for accurately documenting my research contributions and professional portfolio.

Again, I'm not asking for priority processing. I simply want to understand whether these requests are progressing normally and whether there is anything that the maintainers or I should do.

If anyone else has experienced similar delays with published GitHub Security Advisories, I'd be very interested to hear about your experience as well.

I'd also appreciate any clarification from the GitHub Security team regarding the current GitHub CNA process.

Thank you very much for your time.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐