On Thu, 11 Jun 2026, 01:41 Hauke Mehrtens, <hauke () hauke-m de> wrote: On 6/10/26 16:14, Lucas Holt wrote: On 6/10/26 8:52 AM, Christian Brabandt wrote: Agree, but they seemed to be swamped by CVE requests for the last couple of months. I have been waiting for up to 3 weeks on the final CVE assignment. I've also had delays getting them, but consider all the AI related reports. We submitted 13 requests for mport package manager recently.
Lucas Holt Luke () FoolishGames com MidnightBSD.org (Free OS) JustJournal.com (Free blogging) Thank you all for the help.
We requested CVE numbers on github about 1 week ago here: https://github.com/openwrt/odhcpd/security/advisories/
We will probably patch the vulnerabilities and also publish them before we have CVE numbers assigned and just update the advisory later. Hello Hauke, I'm operating a CNA (Ygreky) that can assign to projects that do not have any other. Contact vulns () ygreky com if interested. No fees or any conditions for open source.
Kind regards, Marta
On 6/10/26 16:14, Lucas Holt wrote: On 6/10/26 8:52 AM, Christian Brabandt wrote: Agree, but they seemed to be swamped by CVE requests for the last couple of months. I have been waiting for up to 3 weeks on the final CVE assignment. Lucas Holt Luke () FoolishGames com MidnightBSD.org (Free OS) JustJournal.com (Free blogging) Thank you all for the help.
We requested CVE numbers on github about 1 week ago here: https://github.com/openwrt/odhcpd/security/advisories/ Hauke
They did say they already requested CVEs that way.
I just asked some Github staff about the current situation, and apparently May was the highest volume month ever. So, there's a backlog they're trying to work through and catch up.
Someone also pointed me to this guide if you wanted to become a CNA yourself: https://sethmlarson.dev/security-developer-in-residence-weekly-report-17#becoming-a-cve-numbering-authority-as-an-open-source-project
Hopefully the Github team will catch up soon and get back to their usual timeliness.
- Sam
On Wed, 2026-06-10 at 11:27 +0000, Marcus Meissner wrote: Hi,
I concur, if you use github, its easiest workflow wise to use the Github Security Advisories and their CVE allocation ability.
Ciao, Marcus On Wed, Jun 10, 2026 at 05:36:03PM +0800, swing sze wrote: HI,
https://github.com/openwrt/odhcpd/security
Are you using the GitHub Security Advisor feature to submit CVEs?
Hauke Mehrtens <hauke () hauke-m de> 于2026年6月10日周三 16:59写道： Hi,
How to get a CVE number as a community driven open source project (OpenWrt)? We do not have a security department or a big company backing us.
Multiple security problems were reported to OpenWrt in the last few months. We want to assign CVE numbers to these problems, but have problems requesting numbers.
We contacted mitre in the past, but did not got a response within 2 weeks. Using github security advisories worked fine 2 months ago, we got a CVE number in some days. Currently this does not work any more, we are already waiting for 1 week.
How to get a CVE number?
We (OpenWrt) are a community driven open source project and got multiple reports from individuals and organizations like OpenAI.
We requested multiple CVE Numbers on github for this project: https://github.com/openwrt/odhcpd
Hauke
You can try VulnCheck — https://www.vulncheck.com/advisories/report On Jun 9, 2026, at 3:32 PM, Hauke Mehrtens <hauke () hauke-m de> wrote:
Hi,
How to get a CVE number as a community driven open source project (OpenWrt)? We do not have a security department or a big company backing us.
Multiple security problems were reported to OpenWrt in the last few months. We want to assign CVE numbers to these problems, but have problems requesting numbers.
We contacted mitre in the past, but did not got a response within 2 weeks. Using github security advisories worked fine 2 months ago, we got a CVE number in some days. Currently this does not work any more, we are already waiting for 1 week.
How to get a CVE number?
We (OpenWrt) are a community driven open source project and got multiple reports from individuals and organizations like OpenAI.
We requested multiple CVE Numbers on github for this project: https://github.com/openwrt/odhcpd
Hauke