# GCVE BCP-05-X-03: Vulnerability Handling and Disclosure Timeline

**URL:** <https://discourse.ossbase.org/t/gcve-bcp-05-x-03-vulnerability-handling-and-disclosure-timeline/1129>\
**Category:** GCVE\
**Tags:** bcp-05\
**Created:** [September 27, 2026, 3:02pm UTC](https://discourse.ossbase.org/t/gcve-bcp-05-x-03-vulnerability-handling-and-disclosure-timeline/1129 "2026-09-27T15:02:57Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [October 4, 2026, 9:25am UTC](https://discourse.ossbase.org/t/gcve-bcp-05-x-03-vulnerability-handling-and-disclosure-timeline/1129/4 "2026-10-04T09:25:22Z")

</div>

Major update to BCP-05-X-03 to ensure interoperability with CSAF 2.1:

> **[fix: \[BCP-05-X-03\] Version 1.1 - Interoperability - CSAF 2.1 added ·...](https://github.com/gcve-eu/gcve.eu/commit/cec00b01c5b544b5f0aa7bd4d78e00bfddf87667)**
>
> Add guidance for mapping disclosure timeline events to CSAF 2.1 involvements
> while preserving the distinction between factual events, workflow state,
> coordination actions, and regulatory processes....

The updated version is available online:

> **[GCVE BCP-05-X-03 - Vulnerability Handling and Disclosure Timeline](https://gcve.eu/bcp/extension/gcve-bcp-05-x-03/)**
>
> This document defines an extension to GCVE BCP-05 for representing the handling, coordination, remediation, disclosure, regulatory notification, and interoperability timeline associated with a vulnerability advisory.

and the follow-up discussion on the CSAF GitHub repository:

> <https://github.com/oasis-tcs/csaf/issues/1486>
>
> We should rework the involvements object to make sure it can reflect all actions… and states that can occur in CVD and coordination. As a starting point, we can use \[Vultron\](https://certcc.github.io/Vultron/) (also \[here\](https://github.com/CERTCC/Vultron)). Looking to @sei-vsarvepalli to take make a suggestion and @justmurphy to coordinate the work.

---

_[View the full topic](https://discourse.ossbase.org/t/gcve-bcp-05-x-03-vulnerability-handling-and-disclosure-timeline/1129)._