GCVE-BCP-11 - Community-Proposed Updates to Existing CVE Records

GCVE-BCP-11 - Community-Proposed Updates to Existing CVE Records

  • Version: 1.0
  • Status: Draft (for Public Review)
  • Date: 2026-07-13
  • Authors: GCVE Working Group
  • BCP ID: BCP-11

This guide is distributed and available under CC-BY-4.0.

Copyright (C) 2026 GCVE Initiative.

Abstract

This Best Current Practice defines a mechanism for publishing collaborative proposals to correct, enrich, or extend existing CVE records.

A reserved GCVE Numbering Authority, GNA 65530, is dedicated exclusively to producing community-maintained update records associated with existing CVE identifiers. These records are intended to consolidate technically supported proposals that have not yet been incorporated into the authoritative CVE record.

Typical proposals include corrections to affected-product information, additional references, improved descriptions, Common Platform Enumeration (CPE) or Package URL (PURL) mappings, severity assessments, remediation information, and other structured extensions.

Records published by GNA 65530 MUST follow the GCVE container format defined in GCVE-BCP-05. They MAY use additional x_ extensions where information cannot be represented in the standard CVE Record Format or the core GCVE container.

The mechanism does not replace, override, or modify the authoritative CVE record. It provides an additional, openly available feed that CVE Numbering Authorities, vendors, researchers, vulnerability databases, and other consumers can use to identify and potentially integrate community-proposed improvements.

Introduction

Vulnerability information frequently evolves after the initial publication of a CVE record. Researchers, software distributors, downstream vendors, users, and vulnerability intelligence providers may subsequently identify:

  • additional affected or unaffected versions;
  • incorrect or incomplete product mappings;
  • missing CPE or PURL identifiers;
  • incomplete technical descriptions;
  • new references, patches, or remediation information;
  • corrections to severity or weakness classifications;
  • ecosystem-specific information;
  • machine-readable extensions that cannot be represented in the original record.

Ideally, such information is submitted to the responsible CVE Numbering Authority (CNA) and incorporated into the authoritative CVE record.

In practice, an originating CNA may be unavailable, no longer operational, unable to process community contributions, or unwilling to incorporate a proposed update. A CNA may also lack the tooling or resources required to collect and evaluate contributions from multiple independent communities.

As a result, relevant vulnerability information can remain fragmented across issue trackers, vendor advisories, distribution notices, security research, vulnerability databases, and informal discussions.

This BCP establishes a dedicated publication mechanism through GNA 65530 to consolidate these proposals into structured, reviewable, and machine-readable records.

Scope

GNA 65530 is reserved exclusively for records that propose updates to an existing CVE record.

Every record published by GNA 65530:

  1. MUST reference exactly one existing CVE identifier as its primary target;
  2. MUST represent a proposed correction, enrichment, extension, or consolidation of information related to that CVE;
  3. MUST use the GCVE container format defined in GCVE-BCP-05;
  4. MUST use the update record type;
  5. MUST contain sufficient provenance to identify the sources supporting the proposed changes;
  6. MUST remain distinguishable from the authoritative CVE record.

GNA 65530 MUST NOT:

  • allocate a new CVE identifier;
  • publish a record for a vulnerability that has no existing CVE identifier;
  • claim ownership of the referenced CVE;
  • present its record as an authoritative replacement for the originating CNA record;
  • modify or redistribute an existing CVE record without identifying the proposed changes and their provenance;
  • publish unrelated advisories, analyses, or vulnerability records outside this defined purpose.

Where no CVE identifier exists, a normal GNA SHOULD allocate a regular GCVE identifier according to GCVE-BCP-04 instead of using GNA 65530.

Purpose of Reserved GNA 65530

The purpose of GNA 65530 is to maintain a collaborative update layer for CVE records.

This update layer has four primary objectives:

  1. Consolidation: Gather technically supported proposals from multiple communities into a single structured record associated with the relevant CVE.
  2. Preservation: Ensure that proposed corrections and enrichments remain publicly accessible even when they are not incorporated into the authoritative CVE record.
  3. Interoperability: Make the proposals available in a machine-readable format compatible with existing CVE and GCVE tooling.
  4. Upstream reuse: Enable the responsible CNA or another authorized CVE Program participant to review and automatically integrate accepted information into the authoritative CVE record.

GNA 65530 acts as a collaborative staging and publication mechanism. It is not an alternative CNA and does not supersede decisions made by the CVE Program or the CNA responsible for the original record.

Identifier Allocation

A GNA 65530 record MUST have its own GCVE identifier.

For a target CVE identifier using the format:

CVE-<YEAR>-<SEQUENCE>

the corresponding GNA 65530 identifier SHOULD use:

GCVE-65530-<YEAR>-<SEQUENCE>

For example:

CVE-2026-12345

would normally be associated with:

GCVE-65530-2026-12345

This deterministic mapping provides a simple one-to-one relationship between the original CVE and its community update record.

The GNA 65530 identifier:

  • identifies the collaborative update record;
  • MUST NOT be interpreted as a newly allocated vulnerability;
  • MUST NOT be used as a replacement for the CVE identifier;
  • SHOULD remain stable across subsequent revisions of the collaborative record.

Only one canonical GNA 65530 update record SHOULD exist for each CVE identifier. New accepted proposals SHOULD update the existing record instead of creating additional GNA 65530 identifiers for the same CVE.

Record Format

All GNA 65530 records MUST follow GCVE-BCP-05.

The GCVE container MUST include:

  • vulnId, containing the GNA 65530 identifier;
  • recordType, set to update;
  • relationships, containing a relationship to the target CVE.

The relationship to the target CVE SHOULD use the equal relationship type because the GNA 65530 record concerns the same underlying vulnerability while proposing updated or extended information.

Example:

{
  "x_gcve": [
    {
      "vulnId": "GCVE-65530-2026-12345",
      "recordType": "update",
      "relationships": [
        {
          "destId": "CVE-2026-12345",
          "type": "equal"
        }
      ]
    }
  ]
}

The complete published document SHOULD contain a consumable representation of the proposed updated CVE record rather than only an unstructured description of the changes.

Information that can be represented using standard CVE Record Format fields SHOULD use those fields. Information that cannot be represented in the standard format MAY be included through GCVE or x_ extensions.

Community Update Extension

A GNA 65530 record MAY contain an x_gcve_community_update extension to describe the update process, provenance, review status, and relationship with the authoritative CVE record.

An example structure is:

{
  "x_gcve": [
    {
      "vulnId": "GCVE-65530-2026-12345",
      "recordType": "update",
      "relationships": [
        {
          "destId": "CVE-2026-12345",
          "type": "equal"
        }
      ],
      "x_gcve_community_update": {
        "targetId": "CVE-2026-12345",
        "status": "active",
        "baseRecordDateUpdated": "2026-05-12T09:30:00Z",
        "contributors": [
          {
            "name": "Example Security Community",
            "reference": "https://example.invalid/proposal/12345"
          }
        ],
        "changes": [
          {
            "path": "containers.cna.affected",
            "action": "add",
            "summary": "Add the affected package and corrected version range.",
            "references": [
              "https://example.invalid/advisory/12345"
            ]
          },
          {
            "path": "containers.cna.descriptions",
            "action": "replace",
            "summary": "Clarify the vulnerability preconditions and impact.",
            "references": [
              "https://example.invalid/research/12345"
            ]
          }
        ],
        "review": {
          "status": "reviewed",
          "reviewedAt": "2026-07-13T12:00:00Z"
        },
        "upstream": {
          "submissionStatus": "submitted",
          "submittedAt": "2026-07-10T08:00:00Z"
        }
      }
    }
  ]
}

The extension is OPTIONAL, but implementations are encouraged to provide equivalent provenance and review information.

targetId

The targetId field identifies the CVE record to which the proposed update applies.

It MUST be identical to the CVE identifier referenced in the relationships field.

status

The status field describes the lifecycle state of the collaborative record.

Recommended values are:

  • draft — proposals are being collected and have not yet completed review;
  • active — the record contains reviewed proposals that have not been fully integrated upstream;
  • submitted — the proposals have been submitted to the responsible CNA or another authorized CVE Program participant;
  • partially_integrated — some, but not all, proposed changes have been incorporated into the authoritative CVE record;
  • integrated — all relevant proposed changes have been incorporated into the authoritative CVE record;
  • superseded — the collaborative record has been replaced by a newer mechanism or record;
  • disputed — one or more material proposals remain subject to unresolved technical disagreement;
  • withdrawn — the proposals were found to be incorrect, unsupported, or no longer applicable.

baseRecordDateUpdated

The optional baseRecordDateUpdated field identifies the version of the authoritative CVE record used as the basis for the collaborative update.

This field SHOULD contain the dateUpdated value from the source CVE record when available.

Consumers can use this value to detect whether the authoritative record has changed since the collaborative proposal was prepared.

contributors

The contributors array identifies individuals, organizations, projects, vendors, distributions, or communities that supplied information included in the proposed update.

Contributors SHOULD be credited when they consent to attribution.

Each contribution SHOULD include a public reference or another verifiable source whenever possible.

Anonymous contributions MAY be accepted, but the GNA 65530 maintainers MUST independently validate the associated claims before publication.

changes

The changes array describes material differences between the authoritative CVE record and the collaborative update.

Each change SHOULD include:

  • the field or logical area affected;
  • the type of action proposed;
  • a concise explanation;
  • supporting references or evidence.

Recommended action values are:

  • add;
  • replace;
  • remove;
  • correct;
  • extend;
  • deprecate.

A machine-readable JSON Patch or another standardized difference format MAY also be included as an extension.

review

The review object describes the validation performed before publication.

A published active record SHOULD have received human review.

The review process SHOULD verify that:

  • the target CVE exists;
  • the proposal concerns the same underlying vulnerability;
  • the supporting references are accessible and relevant;
  • affected-product claims are technically supported;
  • proposed identifiers correspond to the correct products or packages;
  • the proposal does not introduce confidential or embargoed information;
  • community disagreements are represented accurately.

upstream

The optional upstream object records interactions with the responsible CNA or other CVE Program participants.

It MAY include:

  • whether the proposal has been submitted;
  • when it was submitted;
  • the submission channel;
  • the response status;
  • references to public discussions or issue trackers;
  • whether the proposal was accepted, partially accepted, rejected, or left unanswered.

Sensitive correspondence or personal contact information MUST NOT be published without authorization.

Types of Proposed Updates

GNA 65530 records MAY include proposals concerning any technically relevant part of an existing CVE record.

Examples include:

Product and Version Information

Proposals may correct or extend:

  • vendor names;
  • product names;
  • package names;
  • affected versions;
  • unaffected versions;
  • fixed versions;
  • version constraints;
  • platform-specific conditions;
  • downstream distribution information.

CPE and Package Identifiers

Proposals may add or correct:

  • CPE identifiers;
  • PURL identifiers;
  • software package coordinates;
  • repository identifiers;
  • relationships between upstream projects and downstream packages.

Where an identifier cannot be incorporated into the standard CVE Record Format, it MAY be represented using an appropriate GCVE extension.

CPE-related proposals SHOULD follow the recommendations in GCVE-BCP-10.

Description and Technical Details

Proposals may improve:

  • vulnerability descriptions;
  • attack preconditions;
  • impact statements;
  • affected components;
  • root-cause information;
  • authentication or privilege requirements;
  • distinctions between separate vulnerabilities.

The proposed description SHOULD remain factual and SHOULD distinguish verified information from assumptions or unresolved analysis.

Severity and Classification

Proposals may include:

  • CVSS vectors and scores;
  • CWE classifications;
  • CAPEC references;
  • ecosystem-specific severity ratings;
  • exploitation prerequisites;
  • prioritization information.

The source and version of each scoring or classification system SHOULD be identified.

Conflicting severity assessments MAY coexist when their sources and scoring assumptions are clearly documented.

References and Remediation

Proposals may add:

  • vendor advisories;
  • patches or commits;
  • distribution advisories;
  • technical analyses;
  • proof-of-concept references;
  • mitigations;
  • workarounds;
  • upgrade instructions;
  • detection guidance.

References MUST be relevant to the target vulnerability and SHOULD use stable, publicly accessible locations.

Extensions

GNA 65530 records MAY include extensions that are not currently accepted or supported by the CVE Program.

Examples include:

  • enhanced CPE or PURL relationships;
  • AI-assisted annotations;
  • structured provenance;
  • community review metadata;
  • detection artifacts;
  • ecosystem-specific package information;
  • richer vulnerability relationships;
  • alternative severity or prioritization systems.

Extensions MUST follow the namespace recommendations in GCVE-BCP-05.

Contribution and Review Process

Community proposals SHOULD be accepted through an open and documented contribution mechanism.

A contribution process SHOULD support:

  1. submission of a proposed change;
  2. identification of the target CVE;
  3. submission of supporting evidence;
  4. discussion and technical review;
  5. resolution of duplicates or conflicting proposals;
  6. publication of accepted changes;
  7. preservation of the contribution history;
  8. submission of the consolidated proposal to the responsible CNA where possible.

A proposal MUST NOT be accepted solely because it has broad community support. Technical claims MUST be supported by verifiable evidence.

The review process SHOULD include subject-matter experts when proposals involve complex version ranges, package ecosystems, hardware products, protocol behavior, or other specialized domains.

Consolidation of Multiple Proposals

Multiple communities may independently propose updates to the same CVE.

GNA 65530 SHOULD consolidate compatible proposals into a single canonical record.

The consolidated record SHOULD:

  • preserve attribution for each accepted contribution;
  • remove duplicate information;
  • identify conflicts between sources;
  • avoid presenting unresolved claims as established facts;
  • retain a history of material revisions;
  • indicate which proposals have completed review.

When two proposals conflict, maintainers SHOULD attempt to resolve the disagreement using available technical evidence.

If no resolution is possible, the record MAY:

  • document both positions;
  • mark the relevant section as disputed;
  • include the evidence supporting each position;
  • avoid automatically replacing the corresponding authoritative CVE field.

Relationship with the Responsible CNA

The responsible CNA remains the authoritative party for the CVE record within the CVE Program.

Whenever practical, accepted GNA 65530 proposals SHOULD be submitted to the responsible CNA.

A CNA MAY consume the GNA 65530 feed to:

  • identify pending community corrections;
  • import additional references;
  • update affected-product information;
  • retrieve CPE or package mappings;
  • review consolidated community evidence;
  • automatically prepare an upstream CVE update.

The feed SHOULD be designed so that a CNA can compare:

  • the current authoritative CVE record;
  • the CVE version used as the basis of the proposal;
  • the complete proposed record;
  • the individual proposed changes;
  • the supporting references;
  • the review status.

When the CNA updates the authoritative CVE record, GNA 65530 maintainers SHOULD compare the upstream change with the collaborative proposal.

The GNA 65530 record SHOULD then be marked as:

  • integrated, when the relevant proposals have been incorporated;
  • partially_integrated, when only some proposals have been incorporated;
  • active, when material proposals remain outstanding;
  • superseded, when the upstream record makes the collaborative record obsolete.

An integrated record SHOULD remain available for historical reference and attribution.

Orphaned and Unmaintained CVE Records

A CVE record may be considered operationally orphaned when:

  • the originating CNA no longer exists;
  • the originating CNA has left the CVE Program;
  • the affected vendor or project is no longer maintained;
  • no responsible party can be contacted;
  • repeated technically supported update requests remain unanswered;
  • responsibility for updating the record is unclear.

GNA 65530 provides a persistent location for improvements to such records.

The designation of a record as orphaned is operational and does not transfer ownership of the CVE identifier to GNA 65530.

Where another CNA or CVE Program participant assumes responsibility for the record, the GNA 65530 proposals SHOULD be made available to that organization for potential integration.

Publication and Distribution

GNA 65530 records MUST be published using the decentralized publication mechanisms described in GCVE-BCP-03.

The publication service SHOULD provide:

  • a machine-readable API;
  • a complete static dump;
  • incremental updates;
  • stable identifiers;
  • revision timestamps;
  • provenance information;
  • an open redistribution licence;
  • sufficient history to audit material changes.

Consumers SHOULD be able to query GNA 65530 records by their target CVE identifier.

A dedicated feed containing only active or unresolved community proposals MAY also be provided.

Consumer Guidance

Consumers MUST treat GNA 65530 records as community-proposed updates and not as authoritative replacements for CVE records.

Applications presenting information from GNA 65530 SHOULD clearly distinguish:

  • information originating from the authoritative CVE record;
  • information proposed by the community;
  • information reviewed by GNA 65530 maintainers;
  • information integrated by the responsible CNA;
  • disputed or unverified proposals.

Automated systems MAY merge selected GNA 65530 information with CVE data, but SHOULD retain field-level provenance.

Security scanners and vulnerability management tools SHOULD avoid silently replacing authoritative affected-product information with a community proposal unless their policy explicitly permits this behavior.

Security, Trust, and Abuse Considerations

A collaborative update mechanism can be targeted by inaccurate, misleading, or malicious submissions.

GNA 65530 maintainers SHOULD implement controls to mitigate:

  • false affected-product claims;
  • malicious CPE or package mappings;
  • reference spam;
  • manipulated severity scores;
  • attempts to associate unrelated vulnerabilities;
  • removal of valid affected versions;
  • unsupported claims of exploitation;
  • impersonation of vendors or researchers;
  • disclosure of confidential vulnerability information;
  • coordinated attempts to influence automated vulnerability-management systems.

Material proposals SHOULD receive human review before being marked active.

Every accepted proposal SHOULD retain sufficient provenance to permit independent verification.

Corrections and withdrawals MUST remain visible in the revision history.

The publication mechanism SHOULD support cryptographic integrity protection and authenticated submissions.

Licensing

GNA 65530 records SHOULD be distributed under an open licence that permits reuse, modification, and redistribution.

CC0 is recommended for machine-readable vulnerability data where possible. CC-BY-4.0 MAY be used where attribution is required.

References and externally contributed content remain subject to their respective licences.

Summary of Requirements

A conforming GNA 65530 implementation:

  • MUST publish only proposed updates to existing CVE records;
  • MUST assign a stable GCVE-65530-* identifier to each collaborative record;
  • MUST use the GCVE-BCP-05 format;
  • MUST use recordType set to update;
  • MUST reference the target CVE through relationships;
  • MUST preserve provenance for material proposed changes;
  • MUST distinguish its records from authoritative CVE records;
  • MUST NOT allocate new CVE identifiers;
  • MUST NOT claim to replace the responsible CNA;
  • SHOULD maintain one canonical collaborative record per CVE;
  • SHOULD consolidate compatible community proposals;
  • SHOULD submit reviewed proposals to the responsible CNA;
  • SHOULD track whether proposals were integrated upstream;
  • SHOULD preserve integrated and superseded records for historical reference;
  • MAY use GCVE extensions for information that cannot be represented in the standard CVE Record Format.
2 Likes

Some notes following feedback from social networks:

  • A question was raised about the dispute resolution for that special GNA. It’s a special case but it doesn’t block other GNA to counter comment with the relationship model of BCP-05.
  • Implementation. Which software will take the proposal and push to the special GNA. cpe-editor/vulnerability-lookup.

I will try to construct a few json records for real instances of CVEs that could benefit from this when I have some time and see if any issues arise from that.

2 Likes

I really like the proposal, but I wonder how this will work if the GNA-65530 record only contains the updates. Will you have to implement a two-step lookup so that when you find a match in the GNA-65530, then you then have to follow the link to the original CVE record to get the full information?

Practical example with Java - CVE-2026-22008: most Java vulnerabilities only include Oracle Java CPE’s. OpenJDK and Azul publish feeds with how the Java vulnerabilities affect their versions. It will be very easy to create GCVE advisory GCVE-65530-2026-22008 which will include the affected OpenJDK and Azul versions.

If that GCVE record only contains the additional affected CPE’s and not the rest of the vulnerability information (severity, description, etc.), then (traditional) vulnerability scanners will have to implement a two-step approach: if they find a CPE match on GCVE-65530-*, then they also have to lookup the referenced CVE records to find out the actual severity.

2 Likes

That is what the action is trying to tell you though. If only a small part of an upstream record is incorrect, then you only need to address that part rather than having to take the entire record into curation which you then have to attempt to keep reconciled with every change to the upstream record. For Oracle specifically though I would end up creating one of these for every single one of their CVEs anyways because the information they supply is not particularly useful. But yes, it would be on the various scanners to look at the whole universe of GCVE records and decide which pieces they want to use to construct their records. GCVE is meant to be a decentralised system; however, this proposal provides a small amount of centralisation to make it a bit easier to not have to repeat corrections everywhere since the already centralised CVE program will not take on that responsibility.

1 Like

I think this will get us to a much better state than we are currently, but I will try it out on some of the recent examples we’ve found to see how it works out.

(Editing existing comment because apparently a new user can only post 3 times to a topic)

Also, if this goes forward and is integrated with vulnerability-lookup, perhaps a view could be implemented for those who choose to trust the community curations that does all of the merging and presents a unified view of a CVE so that consumers don’t all have to try and implement that logic. Would that be helpful?

1 Like

So something like https://codeberg.org/westonsteimel/gcve-bcp-11/raw/branch/main/data/GCVE-65530-2020-15647.json for the fairly trivial product name and affected version fix needed for CVE-2020-15647?

Of course it will get more complex when there are multiple affected items and we are only wanting to affect a single one, but I guess that is where

A machine-readable JSON Patch or another standardized difference format MAY also be included as an extension.

comes in? I wasn’t sure how/where to represent that yet though

[
  {
    "op": "replace",
    "path": "/containers/cna/affected/0/product",
    "value": "Firefox for Android"
  },
  {
    "op": "replace",
    "path": "/containers/cna/affected/0/versions/0/lessThan",
    "value": "64.18.1"
  }
]

I have since pushed a second update that extends the existing affected entry with platforms and cpes and adds the json patches to a patch property within the changes section, but that can be modified if necessary, just wanted to capture them somewhere for now.

1 Like

GCVE-BCP-11 — Community Contribution Fragments for Existing CVE Records

  • Version: 1.1
  • Status: Draft (for Public Review)
  • Date: 2026-07-30
  • Authors: GCVE Working Group
  • BCP ID: BCP-11

This guide is distributed and available under CC-BY-4.0.

Copyright (C) 2026 GCVE Initiative.

Abstract

This Best Current Practice defines a mechanism for publishing community-proposed corrections, enrichments, and extensions to existing CVE records.

GNA 65530 is reserved for these contributions. Each target CVE is associated with one deterministic GCVE-65530-* umbrella identifier. Individual proposals are published as separately identifiable JSON contribution fragments rather than being merged directly into one continuously rewritten record.

Each contribution fragment contains the proposed structured information, provenance, evidence, review status, and optional upstream-submission information. The technical content of a published contribution is immutable. A correction is published as a new contribution that supersedes the previous one. Conflicting contributions may coexist.

A complete merged CVE representation is not normative. Implementations MAY generate a resolved community view that combines the current authoritative CVE record with selected reviewed contributions under an explicit policy.

The design separates contribution storage from record reconciliation, keeping the core implementation small, auditable, and decentralized.

Requirements Language

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals.

Introduction

Vulnerability information frequently evolves after a CVE record is published. Researchers, vendors, software distributions, open-source projects, users, and vulnerability intelligence providers may later identify:

  • additional affected or unaffected versions;
  • incorrect product or package names;
  • missing CPE or Package URL identifiers;
  • incomplete descriptions;
  • additional references, patches, or remediation information;
  • alternative severity assessments;
  • corrected weakness classifications;
  • downstream package information; or
  • structured extensions not represented in the authoritative CVE record.

Ideally, this information is submitted to the responsible CVE Numbering Authority (CNA) and incorporated into the authoritative CVE record.

In practice, the CNA may be unavailable, no longer operational, unable to evaluate the contribution, or unwilling to incorporate it. Useful information can therefore remain fragmented across advisories, issue trackers, repositories, research reports, and vulnerability databases.

BCP-11 separates three activities:

  1. Contribution — publishing a supported technical assertion.
  2. Review — evaluating the assertion and its evidence.
  3. Resolution — optionally combining selected assertions with an authoritative CVE record.

BCP-11 defines contribution and review. Resolution is an implementation policy and does not modify the authoritative CVE record.

Design Principles

One assertion, one contribution

A contribution SHOULD contain one technical assertion or one coherent set of closely related assertions.

Unrelated changes SHOULD be published separately so they can be reviewed, superseded, withdrawn, disputed, or integrated independently.

Append instead of rewrite

A new proposal SHOULD create a new contribution fragment.

The technical content of an existing published contribution MUST NOT be silently rewritten.

Preserve provenance

Every material assertion MUST retain sufficient attribution and evidence for independent verification.

Permit disagreement

Conflicting contributions MAY coexist. A contribution does not become authoritative merely because it was published or reviewed.

Keep merging optional

The normative data is the set of contribution fragments. A complete corrected CVE document is an optional derived view.

Do not replace the CNA

The responsible CNA remains authoritative for the CVE record within the CVE Program. GNA 65530 does not claim ownership of, or authority over, the target CVE.

Scope

Every BCP-11 contribution:

  1. MUST reference exactly one existing CVE identifier;
  2. MUST concern the same underlying vulnerability as that CVE;
  3. MUST use the GCVE container format defined in GCVE-BCP-05;
  4. MUST use recordType set to update;
  5. MUST contain a globally unique contributionId;
  6. MUST contain sufficient provenance and evidence;
  7. MUST remain distinguishable from authoritative CVE information; and
  8. MUST NOT claim to replace the authoritative CVE record.

GNA 65530 MUST NOT:

  • allocate new identifiers beside the umbrella identifier in the BCP-11 scope;
  • publish a contribution for an issue without an existing CVE identifier (except for the rejected CVE);
  • claim ownership of the target CVE;
  • silently redistribute a modified CVE record as authoritative;
  • publish unrelated advisories through this mechanism; or
  • publish confidential or embargoed information without authorization.

If no CVE identifier exists, an eligible GNA SHOULD allocate a regular GCVE identifier according to GCVE-BCP-04.

Terminology

Target CVE

The existing CVE identifier to which a contribution applies.

Umbrella identifier

The deterministic GCVE-65530-* identifier associated with one target CVE. It groups all BCP-11 contributions concerning that CVE.

The umbrella identifier does not identify a new vulnerability and does not replace the CVE identifier.

Contribution fragment

A standalone JSON document containing one proposed assertion or one coherent set of closely related assertions about one target CVE.

Technical content

The proposed vulnerability information in the contribution’s content, targets, baseRecord, and optional patch fields.

Administrative metadata

Workflow information such as review status, upstream status, publication state, revision number, and timestamps.

Resolved community view

A generated representation combining an authoritative CVE record with selected contributions according to a declared policy.

Identifier Model

Umbrella identifier

For:

CVE-<YEAR>-<SEQUENCE>

the associated GNA 65530 identifier SHOULD be:

GCVE-65530-<YEAR>-<SEQUENCE>

Example:

CVE-2026-12345
GCVE-65530-2026-12345

Only one umbrella identifier SHOULD exist for each target CVE.

Contribution identifier

Every contribution MUST contain a globally unique contributionId.

A UUID URN is RECOMMENDED:

urn:uuid:0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d

UUID version 7 is RECOMMENDED when supported.

The umbrella identifier groups contributions. The contributionId identifies one contribution.

Relationship

A contribution SHOULD use:

{
  "destId": "CVE-2026-12345",
  "type": "proposes_update_to"
}

proposes_update_to extends the non-exhaustive relationship vocabulary defined by GCVE-BCP-05.

Contribution Fragment Format

A standalone contribution fragment contains exactly one GCVE object in x_gcve.

Minimal example

{
  "x_gcve": [
    {
      "vulnId": "GCVE-65530-2026-12345",
      "recordType": "update",
      "relationships": [
        {
          "destId": "CVE-2026-12345",
          "type": "proposes_update_to"
        }
      ],
      "x_gcve_community_contribution": {
        "contributionId": "urn:uuid:0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d",
        "targetId": "CVE-2026-12345",
        "datePublished": "2026-07-30T08:00:00Z",
        "dateUpdated": "2026-07-30T08:00:00Z",
        "revision": 1,
        "state": "active",
        "intent": "add",
        "areas": [
          "references"
        ],
        "summary": "Add a missing vendor advisory.",
        "contributors": [
          {
            "name": "Example Security Community",
            "type": "community",
            "reference": "https://example.invalid/community"
          }
        ],
        "evidence": [
          {
            "url": "https://example.invalid/advisory/12345",
            "description": "Public vendor advisory for the vulnerability."
          }
        ],
        "content": {
          "references": [
            {
              "url": "https://example.invalid/advisory/12345",
              "tags": [
                "vendor-advisory"
              ]
            }
          ]
        },
        "review": {
          "status": "pending"
        },
        "upstream": {
          "status": "not_submitted"
        }
      }
    }
  ]
}

Core Fields

GCVE container fields

  • vulnId MUST contain the deterministic GNA 65530 umbrella identifier.
  • recordType MUST be update.
  • relationships MUST reference the target CVE.
  • x_gcve_community_contribution MUST contain the contribution defined by this BCP.

contributionId

contributionId MUST uniquely identify the contribution and MUST NOT be reused for technically different content.

targetId

targetId MUST contain the target CVE identifier and MUST equal the relationship’s destId.

Dates and revision

  • datePublished MUST record initial publication.
  • dateUpdated MUST record the latest fragment revision.
  • revision MUST start at 1 and increase whenever administrative metadata changes.

Timestamps MUST use RFC 3339 format.

state

Allowed values are:

  • active;
  • withdrawn;
  • superseded.

The default is active.

intent

Recommended values are:

  • add;
  • correct;
  • remove;
  • clarify;
  • enrich;
  • other.

intent describes the proposal. It is not an instruction to mutate the current CVE record automatically.

areas

areas MUST identify one or more logical areas affected by the contribution.

Values SHOULD correspond to CVE ADP container fields or named x_ extensions, for example:

  • affected;
  • descriptions;
  • metrics;
  • problemTypes;
  • references;
  • solutions;
  • workarounds;
  • configurations;
  • exploits;
  • timeline;
  • x_gcve_cpe;
  • x_gcve_purl;
  • x_gcve_detection.

The list is extensible.

summary

summary MUST concisely explain the assertion and why it matters.

contributors

contributors MUST identify at least one source unless the submission is explicitly anonymous.

A contributor MAY be an individual, organization, vendor, project, distribution, community, researcher, or database.

Anonymous submissions MAY be accepted, but maintainers MUST independently validate them before setting review.status to reviewed.

Personal contact information MUST NOT be published without authorization.

evidence

evidence MUST contain sufficient material to evaluate the assertion.

Evidence may include:

  • vendor or distribution advisories;
  • source-code commits;
  • patches;
  • issue tracker discussions;
  • package metadata;
  • release notes;
  • technical analyses;
  • reproducible tests;
  • public maintainer statements.

Community voting or repetition of an unsupported claim is not sufficient evidence.

content

content contains the proposed structured information.

Where possible, fields inside content SHOULD follow CVE ADP container names and structures.

A contribution SHOULD include only the fields required to express its assertion. It SHOULD NOT copy the complete CVE record.

At least one of content or targets MUST be present.

Optional Fields

baseRecord

baseRecord identifies the authoritative CVE revision used while preparing the contribution.

It MAY contain:

  • dateUpdated;
  • serial;
  • digest;
  • digestAlgorithm;
  • canonicalization.
{
  "baseRecord": {
    "dateUpdated": "2026-05-12T09:30:00Z",
    "serial": 4,
    "digestAlgorithm": "sha-256",
    "canonicalization": "JCS",
    "digest": "sha256:0123456789abcdef..."
  }
}

When a digest is used, RFC 8785 JSON Canonicalization Scheme SHOULD be used before hashing.

A contribution MUST NOT assume that its base record remains the latest CVE record.

targets

targets MAY identify elements in the pinned base record that motivated a correction or removal.

{
  "targets": [
    {
      "path": "/containers/cna/affected/0",
      "description": "The affected entry containing the incorrect product name."
    }
  ]
}

A target path is meaningful only for the exact baseRecord. Consumers MUST NOT apply it to another revision.

supersedes

supersedes MAY contain earlier contributionId values.

{
  "supersedes": [
    "urn:uuid:0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d"
  ]
}

Superseded contributions MUST remain available for history and attribution.

review

Recommended review.status values are:

  • pending;
  • reviewed;
  • rejected;
  • disputed.

A reviewed contribution SHOULD record reviewedAt and MAY record reviewers, notes, or public review references.

A default resolved view SHOULD include only reviewed contributions.

upstream

Recommended upstream.status values are:

  • not_submitted;
  • submitted;
  • partially_integrated;
  • integrated;
  • rejected;
  • no_response.

The object MAY record submission dates, channels, public references, responses, and integration notes.

Publication state, review status, and upstream status are independent dimensions and MUST NOT be collapsed into one status.

patch

A contribution MAY contain an RFC 6902 JSON Patch as a convenience.

A patch:

  • MUST identify a pinned baseRecord;
  • SHOULD begin with test operations;
  • MUST NOT be the only representation of the proposal when content can express it;
  • MUST NOT be applied when the base revision or digest does not match.
{
  "patch": [
    {
      "op": "test",
      "path": "/containers/cna/affected/0/product",
      "value": "Firefox"
    },
    {
      "op": "replace",
      "path": "/containers/cna/affected/0/product",
      "value": "Firefox for Android"
    }
  ]
}

content remains the primary assertion. The patch is only a transformation aid for one exact source record.

contentDigest

A contribution MAY contain a digest of its content object. RFC 8785 canonicalization SHOULD be used before hashing.

A content digest helps prove that an administrative update did not modify the technical assertion.

withdrawalReason

A withdrawn contribution SHOULD explain why it was withdrawn.

Immutability and Revisions

After publication, material changes to the following require a new contribution and a new contributionId:

  • targetId;
  • intent;
  • areas;
  • summary;
  • contributors when attribution materially changes;
  • evidence supporting the assertion;
  • baseRecord;
  • targets;
  • content;
  • patch.

The replacement contribution SHOULD reference the earlier contribution using supersedes.

The following administrative fields MAY be updated in place:

  • dateUpdated;
  • revision;
  • state;
  • review;
  • upstream;
  • withdrawalReason.

Every administrative update MUST increase revision, update dateUpdated, and preserve the previous revision in publication history.

A publication service MUST NOT replace technical content while retaining the same contributionId.

Review and Conflict Handling

The review process SHOULD verify that:

  • the target CVE exists, is allocated or rejected;
  • the contribution concerns the same vulnerability;
  • the evidence is accessible and relevant;
  • product and version claims are supported;
  • package, CPE, and PURL identifiers are correct;
  • severity vectors are valid;
  • assumptions are distinguished from verified facts;
  • confidential information is not disclosed;
  • malicious or irrelevant references are not introduced.

A contribution MUST NOT be marked reviewed solely because it has broad community support.

Conflicting contributions MAY coexist. They MUST retain separate identifiers and provenance.

If a conflict cannot be resolved:

  • the relevant contributions SHOULD be marked disputed;
  • review notes SHOULD describe the disagreement;
  • a default resolved view SHOULD omit the disputed assertion;
  • consumers MUST NOT silently select one position without a declared policy.

Relationship with the Responsible CNA

The responsible CNA remains authoritative for the target CVE record.

Reviewed contributions SHOULD be submitted to the CNA when practical.

When a contribution is integrated upstream:

  • upstream.status SHOULD become integrated;
  • the integration date SHOULD be recorded;
  • a public reference SHOULD be included when available;
  • the contribution SHOULD remain published for audit and attribution.

Publication and Distribution

Contribution fragments MUST be published using the decentralized mechanisms defined by GCVE-BCP-03.

TODO: Some details of implementation to be reviewed.

A publication service SHOULD support:

  • lookup by target CVE;
  • lookup by umbrella identifier;
  • lookup by contributionId;
  • complete and incremental feeds;
  • revision history;
  • provenance;
  • open redistribution;
  • cryptographic integrity protection.

Recommended file layout

GCVE-65530-2026-12345/
├── index.json
├── urn-uuid-0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d.json
├── urn-uuid-0198a75d-8856-75a3-b69f-18b13c356e19.json
└── urn-uuid-0198a77a-f00b-79ab-8270-e166b4348f09.json

Each contribution file is normative.

index.json is a generated convenience document and MAY be rewritten as contributions or statuses change.

Example index

{
  "vulnId": "GCVE-65530-2026-12345",
  "targetId": "CVE-2026-12345",
  "generatedAt": "2026-07-30T12:00:00Z",
  "contributions": [
    {
      "contributionId": "urn:uuid:0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d",
      "state": "active",
      "reviewStatus": "reviewed",
      "areas": [
        "affected"
      ]
    },
    {
      "contributionId": "urn:uuid:0198a75d-8856-75a3-b69f-18b13c356e19",
      "state": "active",
      "reviewStatus": "pending",
      "areas": [
        "references"
      ]
    }
  ]
}

Resolved Community Views

A publication service MAY provide a resolved community view for consumers that do not want to perform separate CVE and contribution lookups.

A resolved view:

  • MUST identify the authoritative CVE input;
  • MUST identify every contribution used;
  • MUST identify its resolution policy;
  • MUST retain field-level or assertion-level provenance;
  • MUST expose unresolved conflicts;
  • MUST NOT be presented as the authoritative CVE record.

A default policy SHOULD:

  • begin with the latest available authoritative CVE record;
  • include only active, reviewed contributions;
  • exclude superseded, withdrawn, rejected, pending, and disputed contributions;
  • avoid applying JSON Patch unless the pinned base record matches;
  • preserve the source of every addition or replacement.

Example resolution metadata:

{
  "x_gcve_resolution": {
    "generatedAt": "2026-07-30T12:00:00Z",
    "targetId": "CVE-2026-12345",
    "policy": "gna-65530-reviewed-contributions-v1",
    "authoritativeInput": {
      "serial": 5,
      "dateUpdated": "2026-07-29T15:20:00Z"
    },
    "contributionInputs": [
      "urn:uuid:0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d"
    ],
    "excludedContributions": [
      {
        "contributionId": "urn:uuid:0198a75d-8856-75a3-b69f-18b13c356e19",
        "reason": "review-pending"
      }
    ],
    "conflicts": []
  }
}

BCP-11 does not define one universal merge algorithm. Different consumers may use different trust policies, but the selected policy and provenance MUST remain visible.

Consumer Guidance

Consumers MUST treat BCP-11 data as community-proposed information.

Consumers SHOULD distinguish:

  • authoritative CNA information;
  • community contributions;
  • reviewed and pending contributions;
  • disputed, withdrawn, and superseded contributions;
  • information integrated upstream.

Consumers MUST NOT:

  • silently present a contribution as CNA-authored information;
  • automatically apply a patch to an unpinned CVE record;
  • discard provenance;
  • assume all contributions under one umbrella identifier are compatible;
  • treat the umbrella identifier as a replacement for the CVE identifier.

Security, Trust, and Abuse Considerations

GNA 65530 maintainers SHOULD mitigate:

  • false affected-product claims;
  • malicious CPE, PURL, or package mappings;
  • reference spam;
  • manipulated scores;
  • unsupported exploitation claims;
  • attempts to remove valid affected versions;
  • impersonation;
  • confidential disclosures;
  • malicious JSON content;
  • oversized or deeply nested documents;
  • coordinated attempts to influence automated vulnerability-management systems.

Implementations SHOULD:

  • validate fragments against a published JSON Schema;
  • limit document size and nesting;
  • validate URLs;
  • sanitize rendered text;
  • avoid automatically fetching untrusted references;
  • preserve history;
  • authenticate maintainers and reviewers;
  • sign published feeds;
  • rate-limit submissions.

Human review SHOULD be required before a contribution enters a default resolved view.

Worked Examples

The examples use example.invalid and are illustrative.

Add a downstream affected package

The original CVE describes the upstream project. A distribution contributes its package-specific affected and fixed versions.

{
  "x_gcve": [
    {
      "vulnId": "GCVE-65530-2026-12345",
      "recordType": "update",
      "relationships": [
        {
          "destId": "CVE-2026-12345",
          "type": "proposes_update_to"
        }
      ],
      "x_gcve_community_contribution": {
        "contributionId": "urn:uuid:0198a75d-8856-75a3-b69f-18b13c356e19",
        "targetId": "CVE-2026-12345",
        "datePublished": "2026-07-30T09:00:00Z",
        "dateUpdated": "2026-07-30T09:00:00Z",
        "revision": 1,
        "state": "active",
        "intent": "enrich",
        "areas": [
          "affected",
          "x_gcve_purl"
        ],
        "summary": "Add the affected package range for Example Linux 12.",
        "contributors": [
          {
            "name": "Example Linux Security Team",
            "type": "distribution",
            "reference": "https://example.invalid/linux/security"
          }
        ],
        "evidence": [
          {
            "url": "https://example.invalid/linux/advisories/ELA-2026-77",
            "description": "Distribution advisory identifying the fixed package."
          }
        ],
        "content": {
          "affected": [
            {
              "vendor": "Example Linux",
              "product": "examplelib",
              "collectionURL": "https://packages.example.invalid",
              "packageName": "examplelib",
              "versions": [
                {
                  "version": "0",
                  "lessThan": "2.4.7-3+el12u1",
                  "versionType": "custom",
                  "status": "affected"
                },
                {
                  "version": "2.4.7-3+el12u1",
                  "status": "unaffected"
                }
              ],
              "defaultStatus": "unknown",
              "x_gcve_purls": [
                "pkg:deb/example-linux/examplelib@2.4.7-3%2Bel12u1"
              ]
            }
          ]
        },
        "review": {
          "status": "reviewed",
          "reviewedAt": "2026-07-30T10:00:00Z"
        },
        "upstream": {
          "status": "not_submitted"
        }
      }
    }
  ]
}

Correct a product and version range

The complete corrected affected item is the primary assertion. The optional patch is tied to one exact CVE revision.

{
  "x_gcve": [
    {
      "vulnId": "GCVE-65530-2020-15647",
      "recordType": "update",
      "relationships": [
        {
          "destId": "CVE-2020-15647",
          "type": "proposes_update_to"
        }
      ],
      "x_gcve_community_contribution": {
        "contributionId": "urn:uuid:0198a77a-f00b-79ab-8270-e166b4348f09",
        "targetId": "CVE-2020-15647",
        "datePublished": "2026-07-30T10:00:00Z",
        "dateUpdated": "2026-07-30T10:00:00Z",
        "revision": 1,
        "state": "active",
        "intent": "correct",
        "areas": [
          "affected"
        ],
        "summary": "Correct the product to Firefox for Android and the affected upper bound to 64.18.1.",
        "contributors": [
          {
            "name": "Example Vulnerability Curator",
            "type": "researcher",
            "reference": "https://example.invalid/researchers/curator"
          }
        ],
        "evidence": [
          {
            "url": "https://example.invalid/mobile/release-notes/64.18.1",
            "description": "Release notes identifying the fixed mobile release."
          }
        ],
        "baseRecord": {
          "serial": 3,
          "digestAlgorithm": "sha-256",
          "canonicalization": "JCS",
          "digest": "sha256:0123456789abcdef..."
        },
        "targets": [
          {
            "path": "/containers/cna/affected/0",
            "description": "The affected entry containing the incorrect product and upper bound."
          }
        ],
        "content": {
          "affected": [
            {
              "vendor": "Mozilla",
              "product": "Firefox for Android",
              "platforms": [
                "Android"
              ],
              "versions": [
                {
                  "version": "0",
                  "lessThan": "64.18.1",
                  "versionType": "custom",
                  "status": "affected"
                }
              ],
              "defaultStatus": "unaffected"
            }
          ]
        },
        "patch": [
          {
            "op": "test",
            "path": "/containers/cna/affected/0/product",
            "value": "Firefox"
          },
          {
            "op": "replace",
            "path": "/containers/cna/affected/0/product",
            "value": "Firefox for Android"
          },
          {
            "op": "replace",
            "path": "/containers/cna/affected/0/versions/0/lessThan",
            "value": "64.18.1"
          }
        ],
        "review": {
          "status": "reviewed",
          "reviewedAt": "2026-07-30T11:00:00Z"
        },
        "upstream": {
          "status": "submitted",
          "submittedAt": "2026-07-30T11:30:00Z",
          "reference": "https://example.invalid/issues/CVE-2020-15647"
        }
      }
    }
  ]
}

If the CVE record later changes, consumers can still understand the contribution from content without applying the patch.

Add an independent severity assessment

The community score does not replace the CNA score. Both can coexist with separate provenance.

{
  "contributionId": "urn:uuid:0198a79d-03ad-7fde-97ab-c2732e043844",
  "targetId": "CVE-2026-12345",
  "state": "active",
  "intent": "enrich",
  "areas": [
    "metrics"
  ],
  "summary": "Add a CVSS v3.1 assessment accounting for authentication and user interaction.",
  "contributors": [
    {
      "name": "Example CSIRT",
      "type": "organization",
      "reference": "https://example.invalid/csirt"
    }
  ],
  "evidence": [
    {
      "url": "https://example.invalid/csirt/analysis/CVE-2026-12345"
    }
  ],
  "content": {
    "metrics": [
      {
        "format": "CVSS",
        "cvssV3_1": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N",
          "baseScore": 7.6,
          "baseSeverity": "HIGH"
        }
      }
    ]
  },
  "review": {
    "status": "reviewed"
  }
}

State that a downstream product is unaffected

An explicit unaffected assertion is preferable to deleting another source’s affected entry.

{
  "contributionId": "urn:uuid:0198a7af-e122-7581-bd66-14f7ff7025fc",
  "targetId": "CVE-2026-12345",
  "state": "active",
  "intent": "enrich",
  "areas": [
    "affected"
  ],
  "summary": "Example Linux 11 is unaffected because the vulnerable feature is disabled at build time.",
  "evidence": [
    {
      "url": "https://example.invalid/linux/build/examplelib.spec"
    }
  ],
  "content": {
    "affected": [
      {
        "vendor": "Example Linux",
        "product": "examplelib",
        "versions": [
          {
            "version": "11",
            "status": "unaffected"
          }
        ],
        "defaultStatus": "unknown"
      }
    ]
  },
  "review": {
    "status": "reviewed"
  }
}

Represent conflicting contributions

Contribution A:

{
  "contributionId": "urn:uuid:0198a7c0-3ec3-7713-8d78-aa9b57f4f620",
  "summary": "The issue is fixed in version 3.2.5.",
  "content": {
    "affected": [
      {
        "vendor": "Example Vendor",
        "product": "Example Product",
        "versions": [
          {
            "version": "0",
            "lessThan": "3.2.5",
            "versionType": "semver",
            "status": "affected"
          }
        ]
      }
    ]
  },
  "review": {
    "status": "disputed",
    "notes": "Another contribution provides evidence for a 3.2.4 fix."
  }
}

Contribution B:

{
  "contributionId": "urn:uuid:0198a7c8-f7eb-7a09-a546-52c242e073ef",
  "summary": "The issue is fixed in version 3.2.4.",
  "content": {
    "affected": [
      {
        "vendor": "Example Vendor",
        "product": "Example Product",
        "versions": [
          {
            "version": "0",
            "lessThan": "3.2.4",
            "versionType": "semver",
            "status": "affected"
          }
        ]
      }
    ]
  },
  "review": {
    "status": "disputed",
    "notes": "The package changelog conflicts with the other contribution's advisory."
  }
}

Both remain available. A default resolved view omits the disputed version correction.

Supersede a contribution

New evidence shows that a previously proposed fixed version was incorrect.

{
  "contributionId": "urn:uuid:0198a7df-8e63-73d7-a21d-7d84bf981b8d",
  "targetId": "CVE-2026-12345",
  "state": "active",
  "intent": "correct",
  "areas": [
    "affected"
  ],
  "summary": "Correct the fixed version to 3.2.5 because the 3.2.4 patch was incomplete.",
  "supersedes": [
    "urn:uuid:0198a7c8-f7eb-7a09-a546-52c242e073ef"
  ],
  "evidence": [
    {
      "url": "https://example.invalid/project/commits/final-fix"
    }
  ],
  "content": {
    "affected": [
      {
        "vendor": "Example Vendor",
        "product": "Example Product",
        "versions": [
          {
            "version": "0",
            "lessThan": "3.2.5",
            "versionType": "semver",
            "status": "affected"
          }
        ]
      }
    ]
  },
  "review": {
    "status": "reviewed"
  }
}

The older contribution remains published and its administrative state becomes superseded.

Withdraw a contribution

The technical content is not edited. Only administrative metadata changes.

{
  "contributionId": "urn:uuid:0198a7af-e122-7581-bd66-14f7ff7025fc",
  "datePublished": "2026-07-30T13:00:00Z",
  "dateUpdated": "2026-08-02T10:00:00Z",
  "revision": 2,
  "state": "withdrawn",
  "withdrawalReason": "The build configuration was for a development branch and did not apply to the released package.",
  "review": {
    "status": "rejected",
    "reviewedAt": "2026-08-02T09:30:00Z"
  },
  "upstream": {
    "status": "not_submitted"
  }
}

The publication service retains the earlier revision.

Generate a resolved view

The following is derived data, not a contribution fragment:

{
  "x_gcve_resolution": {
    "generatedAt": "2026-07-30T12:00:00Z",
    "targetId": "CVE-2026-12345",
    "policy": "gna-65530-reviewed-contributions-v1",
    "authoritativeInput": {
      "serial": 5,
      "dateUpdated": "2026-07-29T15:20:00Z"
    },
    "contributionInputs": [
      "urn:uuid:0198a74b-4f14-7d4e-a1c0-9aa7f7c6628d",
      "urn:uuid:0198a75d-8856-75a3-b69f-18b13c356e19"
    ],
    "excludedContributions": [
      {
        "contributionId": "urn:uuid:0198a7c0-3ec3-7713-8d78-aa9b57f4f620",
        "reason": "disputed"
      }
    ],
    "conflicts": []
  }
}

The generated document may expose CNA data and community data in separate containers so consumers can retrieve one document without losing provenance.

Minimal Implementation Profile

A first implementation only needs:

  1. deterministic umbrella identifiers;
  2. unique contribution identifiers;
  3. standalone contribution fragments;
  4. structured content;
  5. contributor and evidence metadata;
  6. review status;
  7. supersession and withdrawal;
  8. lookup by target CVE;
  9. administrative revision history.

The following MAY be implemented later:

  • JSON Patch;
  • content digests;
  • resolved views;
  • automatic CNA submission;
  • conflict detection;
  • contributor trust policies;
  • signatures for individual contributions.

An implementation does not need a universal merge engine to conform to the core BCP.

Summary of Requirements

A conforming GNA 65530 implementation:

  • MUST publish only contributions concerning existing CVE records;
  • MUST use one deterministic umbrella identifier per target CVE;
  • MUST give every contribution a globally unique contributionId;
  • MUST use the GCVE-BCP-05 container format;
  • MUST use recordType set to update;
  • MUST reference the target CVE;
  • MUST preserve provenance and evidence;
  • MUST distinguish contributions from authoritative CVE information;
  • MUST preserve published technical content;
  • MUST create a new contribution for a material technical correction;
  • MUST preserve superseded and withdrawn contributions;
  • MUST NOT claim to replace the responsible CNA;
  • SHOULD use ADP-compatible structures inside content;
  • SHOULD keep contributions independently reviewable;
  • SHOULD submit reviewed contributions to the CNA when practical;
  • MAY publish conflicting contributions;
  • MAY include an RFC 6902 patch tied to a pinned base record;
  • MAY generate a resolved community view;
  • MUST preserve provenance in any resolved view.

Rationale

The contribution-fragment model avoids requiring GNA 65530 to continuously reconstruct and reconcile a complete replacement-like CVE record.

It provides:

  • independent attribution;
  • append-oriented publication;
  • straightforward review;
  • visible correction history;
  • explicit conflict representation;
  • stable grouping;
  • compatibility with CVE ADP-style content;
  • optional unified views for scanners and other consumers.

The central design rule is:

BCP-11 publishes contributions. A resolver may generate a view. The CNA remains authoritative.

1 Like

Thanks a lot for your testing and feedback. It sparked several discussions about the implementation complexity of BCP-11. As a result, we rewrote the proposal and slightly revised the model, as described in the new BCP-11 version published in the same thread:

Feel free to review it. It would be great if you could update your examples to use the new format, so we can confirm that we’re on the right track.

1 Like

Thanks, yes I had realised there were some issues if the upstream record changed from under you, but it looks like you already discovered that and have some good ideas around handling that. Also I didn’t realise there was a test operation for json patch. Thanks for pointing that out, that is really useful!

I am actually starting a new experiment around getting an initial set of potential patches for this. Essentially, my plan is to actually fork the upstream GitHub - CVEProject/cvelistV5: CVE cache of the official CVE List in CVE JSON 5 format · GitHub repo and start applying some of our enrichments directly to it, while keeping in sync with upstream and resolving merge conflicts as they happen. The idea is that we should then be able to generate the diffs between our copy and the actual upstream record when all of this is ready.

I was considering starting with GitHub - gcve-eu/gcve-enriched-dumps: Vulnerability advisories automatically enriched (AI-Assisted and VL metadata) · GitHub as the base, but then realised there were some issues with the data there not being up to date.

EDIT: Actually, since the CVEProject/cvelistV5 commits are mostly meaningless and cause that repository to be too large for the initial push to a new hard-forked repo (on GitHub at least), I think I’m just going to start with a clean base that pulls in the upstream json files on some cadence, and then in a separate repo we overlay our changes on top of that. The idea is to for now let git manage the collisions by forcing us to resolve merge conflicts, so we’ll see how burdensome that becomes. But I expect that this should all be complementary to the effort here in that once everything is formalised we should hopefully be able to bring our patches in via this proposed mechanism. Hopefully that makes sense

1 Like

Storing a large dataset with frequent updates in a Git repository may seem like a good idea at first, but it quickly creates several issues. We made this mistake with the GCVE AI-expanded format, and it is actually a recurring problem. Similar challenges can be seen with the official CVE Record repository, and I also remember the CDNjs repository facing comparable difficulties.

The repository becomes painful to clone, extracting meaningful information from commit messages is difficult, and correcting mistakes leaves the obsolete data in the commit history. That is perfectly acceptable for source code, but it is often not desirable for datasets.

We usually provide periodic JSON dumps, such as those available at Vulnerability-Lookup JSON dumps and Index of /. However, we will need a better approach in the future, especially for compiling GNA-provided updates to existing CVE records. Ideas are more than welcome!

Yes, I understand there are many downsides to this approach; however, I think it will work well enough for the time being as a place to start gathering (and keeping up to date!) the sort of contributions that we would like to submit via this new functionality when it is available. But yes, it may not work out very well. We shall see.

EDIT: I think I will also reduce unnecessary churn from the upstream data by limiting the base repo files to only the set of cna properties that we expect to be providing updates for. That should help to reduce merge conflicts due to unnecessary derived properties like x_legacyV4Record and cpeApplicability

I also had the same idea that CVE records are also evolving and merely referring to the CVE number could bring conflicts, especially when using the targetsoptional field. Good to read that the baseRecordshould be used when pinning elements in a targetsfield.

I would like to come back to the generation of a resolved view. Is it possible to include a resolved view in the publication directory next to the index and the contributions? The resolved view can be generated according to a GCVE resolution policy. The GCVE knows exactly when the status of a contribution changes and can regenerate the resolved view. The GCVE can also monitor the CVE for changes to the authoritative CVE record and queue a regeneration when required.

Setting a naming convention for the resolved view can also help to adopt this faster. Tools used by consumers could have a configuration for a publication service base URL and would then be able to find the resolved view acoording to the publisher’s resolution policy. Tools could start with consuming the GCVE resolved view and could allow to point to another publisher if the wish to use another resolution policy.

Thanks for the feedback.

If I understand correctly, you want to have a default resolved view? outside the A publication service MAY provide a resolved community view for consumers that do not want to perform separate CVE and contribution lookups.

You mean to have a resolved view on the special GNA 65530 in the index. So we (as GCVE) provide one and if someone doesn’t like the default GNA resolving view, they can switch to another provider with a different policy.

A first experimental implementation of BCP-11 is available at GitHub - gcve-eu/gcve-lab-cve-updater: Implementation of BCP-11 · GitHub and part of the GCVE lab.

The goal is to see how realistic an implementation of BCP-11 is and check if any shortcoming has been discovered in BCP-11 before publication.