CVE assignment pending past 72-hour SLA for published advisory

[alienkeric]

Discussion Type

Question

Discussion Content

Hi everyone,

I'm reaching out to see if anyone else has been experiencing unusual delays with CVE ID assignments recently, or if there's a recommended way to unblock stalled requests.

Over the past few weeks I've been conducting vulnerability research and responsibly disclosing several issues. The maintainers have requested CVE IDs through GitHub's CNA, but the requests appear to be stalled.

These requests were submitted over four days ago, which is well beyond the typical 72-hour SLA. None of the advisories have received any updates, requests for additional information, or CVE assignments. Since the advisories are already public, we're hoping to have the corresponding CVE IDs assigned as soon as possible so downstream users and security tools can properly track the vulnerabilities.

I have a few questions for the community or any GitHub staff who may be able to help:

• Is GitHub's CNA currently experiencing a backlog or service delay?
• What is the recommended escalation path when multiple public advisories remain stuck? Should we open GitHub Support tickets, or is there another channel specifically for delayed CVE assignments?
• If a GitHub staff member is available, would it be possible to review or manually advance these requests?

(I'm happy to provide direct links if needed.)

Any guidance or assistance would be greatly appreciated. Thank you!

[nicl4ssic]

I've been experiencing the same issue. It's has been like 108hrs since reported vulnerabilities CVE request sent to GitHub. I'll be following this discussion to see what is causing this issue

[gemstone-source]

Same applied on my end I have the similar experience on some of my reports

[blueandhack]

Same. I was facing the same issues. Not only the CVE assignment delay issue, but also the CVE publish delay issue. So, it looks like a huge backlog for CVEs. I believe the backlog will impact the downstream users, the high risk to expose the downstream users without any notices.

[blueandhack]

https://github.com/orgs/community/discussions/199058

[blueandhack]

https://github.com/orgs/community/discussions/197744

[blueandhack]

github/advisory-database#8098

[alienkeric]

I see, I got 6 published advisory with all requested CVE I wonder 🤔 but no CVE id

[alienkeric]

all of them already published and already fixed and already confirmed.
• GHSA-66v2-vxxf-xc3v
• GHSA-7vhm-8x52-2r5p
• GHSA-928x-9mpw-8h56
• GHSA-2c4f-86xc-cr74
• GHSA-m8g9-wxhx-6f86
• GHSA-q532-mvx7-42qg

[alienkeric]

@mgriffin any updates 😔

[alienkeric]

@nicl4ssic @gemstone-source @blueandhack @mgriffin any updates from your side maybe anything worked out from your side, to me no updates

[blueandhack]

No updates. I got the CVE assigned on 6/15 and published on 6/16, but it's still reversed.

[blueandhack]

I contacted the GitHub Advisories Team, and they confirmed the significant backlog for CVE processing. They also mentioned that they cannot expedite individual requests at this time. So they are working on this in order.

https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/

[blueandhack]

Also, they mentioned that it will take about 3 weeks.

[nicl4ssic]

No any updates till now

[alienkeric]

Hello @ebndev, @martinwoodward, @admin @staff @mgriffin

It has been two weeks since the CVE request was submitted with no response or status update. The project maintainer has already done their part by requesting the ID, so the bottleneck is entirely on GitHub’s backend assignment queue. Prolonged delays and a lack of basic communication heavily discourage independent security researchers from engaging in responsible disclosure. Could a GitHub staff member help us on this please, because the advisory are already online and fixed and published as well.

[rashworld-max]

Hi

[alienkeric]

Hello

[gemstone-source]

No updates too

[alienkeric]

hello @nihaonihao045-maker

…

On Tue, 30 Jun 2026 at 00:32, nihaonihao045-maker ***@***.***> wrote: - 你好 — Reply to this email directly, view it on GitHub <#200225?email_source=notifications&email_token=AYOUUAPCXSR2A5CJWRHLM3T5CLOAXA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUG43DOMRRUZZGKYLTN5XKM3LBNZ2WC3FFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-17476721>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AYOUUAOLA3QGWUOXZZ7OJOL5CLOAXAVCNFSNUABIKJSXA33TNF2G64TZHMZTAMJVG4ZTGNBUHNCGS43DOVZXG2LPNY5TCMBTGI2DSNJVUF3AE> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AYOUUAODKZFNDTOM4QOD6BL5CLOAXA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUG43DOMRRUZZGKYLTN5XKM3LBNZ2WC3FFMV3GK3TUVJTG633UMVZF62LPOM> and Android <https://github.com/notifications/mobile/android/AYOUUAKPBJF54OGE5INUSS35CLOAXA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZUG43DOMRRUZZGKYLTN5XKM3LBNZ2WC3FFMV3GK3TUVZTG633UMVZF6YLOMRZG62LE>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.*** com>

[thientd]

@alienkeric Do you have any update for your CVE, Currently I 'm peding issue CVE ID that similar your case :(
GHSA-xm28-xvqc-gxxg
GHSA-526j-582w-7fm9

[alienkeric]

On my side no, still no updates.

[camberty]

I'm facing the same issue... I have two CVE's marked as "requested a CVE 2 weeks ago".

[chutchut]

Same here, 9 days and counting for a CVE id for one of my reports.. 👎

[v-coder247]

Thanks for posting in the GitHub Community, @alienkeric !

You are more likely to get a useful response if you are posting your question in the applicable category, the Discussions category is solely related to conversations around the GitHub product Discussions. This question should be in the "Code Security" category. I've gone ahead and moved it for you. Good luck!

[ReenigneArcher]

Still an issue. I requested some over a week ago and still haven't been issued. I don't think I can wait any longer to publish these.