[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <5B7CE905-96FF-45B6-AB06-E32429C81029@carverauto.dev>
Date: Wed, 10 Jun 2026 09:17:41 -0500
From: Michael Freeman <mfreeman@...verauto.dev>
To: oss-security@...ts.openwall.com
Cc: David Bauer <mail@...id-bauer.net>
Subject: Re: How to request CVE numbers?
You can try VulnCheck — https://www.vulncheck.com/advisories/report
> On Jun 9, 2026, at 3:32 PM, Hauke Mehrtens <hauke@...ke-m.de> wrote:
>
> Hi,
>
> How to get a CVE number as a community driven open source project (OpenWrt)? We do not have a security department or a big company backing us.
>
> Multiple security problems were reported to OpenWrt in the last few months. We want to assign CVE numbers to these problems, but have problems requesting numbers.
>
> We contacted mitre in the past, but did not got a response within 2 weeks. Using github security advisories worked fine 2 months ago, we got a CVE number in some days. Currently this does not work any more, we are already waiting for 1 week.
>
> How to get a CVE number?
>
> We (OpenWrt) are a community driven open source project and got multiple reports from individuals and organizations like OpenAI.
>
> We requested multiple CVE Numbers on github for this project: https://github.com/openwrt/odhcpd
>
> Hauke
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
