Comment by theteapot
13 hours ago
Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.
13 hours ago
Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.
It's not a press embargo in the sense that the whole package of information becomes public once the embargo expires. There will be a published record on the cve.org, but often those who initiated the embargo insist that key details related to the vulnerability remain private even after the existence of the vulnerability and its remediation have been published.
Consider this example:
https://www.cve.org/CVERecord?id=CVE-2026-113119
At this time, the corresponding Chromium bug tracker entry is still private:
https://issues.chromium.org/issues/557075191
(I just picked this one at random, I haven't checked if the information is publicly available from another source.)
No, a CVE being assigned or allocated can happen well in advance. It's just requesting an identifier and it can be reserved very early.
For example: https://www.cve.org/CVERecord?id=CVE-2026-50000
I think that's what they're saying.
Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.
No, CVEs can be allocated before a vulnerability has even been found!
Not sure that contradicts the claim. Publishing the CVE is what makes it public.
The CVE record wasn't published yet when this particular embargo got broken. AFAIK it got published when the embargo ended, as it should. (I wasn't following anymore at that point, don't know for sure.)
What did happen is that a whole bunch of people had no clue and called the fact that "these 2 CVE IDs will be used for a PHP vulnerability" a CVE leak. Posts were going around yelling "CVE leak!" with a CVE database link that said "no information yet". Part of this is the mushed usage of "CVE" to just mean "vulnerability" rather than "CVE record". But still, quite ridiculous, and annoying. Information that CVE ID XYZ will be used for project ABC is *not* a leak. Like you say, CVE publishing matters. Getting the CVE record contents would be a leak.