Vulnerabilities and advisories

Required

• Publish a cybersecurity policy as an open source steward

  OSS-28

  An open source steward under the Cyber Resilience Act publishes a dated cybersecurity policy for each project it supports, by 11 December 2027. It covers how vulnerabilities are recorded, fixed and shared.

• Report actively exploited holes as a steward

  OSS-29

  A steward involved in a project's development reports each actively exploited vulnerability in it through the EU single reporting platform. Do the same for a severe incident on the systems you run for its development.

Recommended

• Send private reports to at least two people

  OSS-22

  Turn on the code host's private vulnerability reporting, and name at least two security contacts in SECURITY.md. Each of them gets every new report.

• Fix a reported hole in private

  OSS-23

  Write and review the fix for a reported vulnerability in a private fork or private branch. Merge it, release it and publish the advisory together, on one day.

• Agree the publication date with the reporter

  OSS-24

  Agree with each reporter when the advisory goes out, and credit them by name in it unless they ask not to be named. Write the agreed date in the private report.

• Get a CVE for every vulnerability in a released version

  OSS-25

  Request a CVE ID for each confirmed vulnerability in a released version before the advisory goes out. Ask the CVE Numbering Authority whose scope covers the project.

• Publish an advisory that tools can read

  OSS-26

  Publish every advisory in the code host's advisory database or in OSV format. Give the ecosystem, the affected range, the first fixed version and a CVSS score.

• Find out your role under the Cyber Resilience Act

  OSS-27

  Record whether the project makes you a manufacturer, an open source steward or neither under the EU Cyber Resilience Act, with the reason. Decide again whenever the project's funding or business model changes.