A couple of weeks ago I have found a vulnerability in a product. I have contacted them reporting it a week ago and also to get the CVE.

I didn't receive any answer from the mailing list and I would like what can I do in such a situation. In Mitre's CVE documentation they said only CNA's can request the CVE.

Thank you in advance.


CNAs can take more than a week to respond. Some are staffed by a small team - sometimes just one person - and if people are on holiday or off sick then there may be delays. If two weeks goes by and you've got nothing back, that's more of a cause for concern.

If you feel like an excessive amount of time has passed you can opt to ask MITRE for a CVE directly and note in your application that the CNA did not respond. You should supply a timeline of communications to support this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.