{"taxonomy_vocabulary_9":[],"body":{"value":"\u003Ch3 id=\u0022summary-problem-motivation\u0022\u003EProblem\/Motivation\u003C\/h3\u003E\n\u003Cp\u003ESpinning this off from side discussion on Slack from April 21st questioning the lack of CVE publication for disclosed CVE ID\u0027s\u003C\/p\u003E\n\u003Cp\u003ECurrently there are a number of SA\u0027s that have a CVE ID\u0027s allocated, publicly and publicly disclosed however not published to the CVE registry.\u003C\/p\u003E\n\u003Cp\u003E\u003Cdel\u003ECVE-2026-4093 - March 18th\u003C\/del\u003E Published May 21st - ~62 days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-4929 - March 23rd\u003C\/del\u003E Published May 21st - ~58 days\u003Cbr \/\u003E\nCVE-2026-5343 - April 1st\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-6095 - April 8th\u003C\/del\u003E  Published May 19th - ~34 days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-6365 - April 15th\u003C\/del\u003E Published May 19th - ~34 days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-6366 - April 15th\u003C\/del\u003E Published May 19th - ~34 days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-6367 - April 15th\u003C\/del\u003E Published May 19th - ~34 days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-6871- April 22nd\u003C\/del\u003E Published May 19th - ~ 27 days\u003Cbr \/\u003E\nCVE-2026-6908 - April 23rd\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-8491 - May 13th\u003C\/del\u003E Published May 19th - ~6 Days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-8492 - May 13th\u003C\/del\u003E Published May 19th - ~6 Days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-8493 - May 13th\u003C\/del\u003E Published May 19th - ~6 Days\u003Cbr \/\u003E\n\u003Cdel\u003ECVE-2026-8495 - May 13th\u003Cbr \/\u003E\n\u003C\/del\u003E Published May 19th - ~6 Days\u003C\/p\u003E\n\u003Cp\u003EAs the Drupal Association and Drupal Security team are aware, or reasonably should be expected to be aware, the CVE program requires that CNA\u0027s publish to the registry within 72 hour of publicly disclosing an ID.\u003C\/p\u003E\n\u003Cblockquote\u003E\u003Cp\u003E4.5.1.4 CNAs MUST publish a CVE Record to the CVE List within 72 hours of Publicly Disclosing a CVE ID assigned by the CNA. \u003C\/p\u003E\u003C\/blockquote\u003E\n\u003Cp\u003E\u003Ca href=\u0022https:\/\/www.cve.org\/Resources\/Roles\/Cnas\/CNA_Rules_v4.1.0.pdf\u0022 rel=\u0022nofollow\u0022\u003Ehttps:\/\/www.cve.org\/Resources\/Roles\/Cnas\/CNA_Rules_v4.1.0.pdf\u003C\/a\u003E\u003C\/p\u003E\n\u003Cp\u003EThe CNA has not met this timeline for the above CVE ID\u0027s.\u003C\/p\u003E\n\u003Cp\u003EAdditionally CNA rules encourage publication within 24 hours\u003C\/p\u003E\n\u003Cblockquote\u003E\u003Cp\u003E4.5.1.3 CNAs SHOULD publish a CVE Record to the CVE List within 24 hours of Publicly Disclosing a CVE ID assigned by the CNA. CNAs MAY publish or update CVE Records as part of the CNA\u2019s processes to manage Vulnerability advisories or other public information that references the CVE ID\u003C\/p\u003E\u003C\/blockquote\u003E\n\u003Cp\u003E\u003Ca href=\u0022https:\/\/www.cve.org\/Resources\/Roles\/Cnas\/CNA_Rules_v4.1.0.pdf\u0022 rel=\u0022nofollow\u0022\u003Ehttps:\/\/www.cve.org\/Resources\/Roles\/Cnas\/CNA_Rules_v4.1.0.pdf\u003C\/a\u003E\u003C\/p\u003E\n\u003Cp\u003EThere has been some attempt to try and crowdsource this data in \u003Cspan class=\u0022project-issue-issue-link project-issue-status-info project-issue-status-7\u0022\u003E\u003Ca href=\u0022\/project\/securitydrupalorg\/issues\/3582693\u0022 title=\u0022Status: Closed (fixed)\u0022\u003E#3582693: Create CVEs for April and early May 2026\u003C\/a\u003E\u003C\/span\u003E. I maintain that without access to the security issues the community is not in a position to properly evaluate or create the data.  Addtionaly the community are not Security Team members\/Drupal CNA members, it is not their responsibility to generate this data.  \u003C\/p\u003E\n\u003Ch4 id=\u0022summary-steps-reproduce\u0022\u003ESteps to reproduce\u003C\/h4\u003E\n\u003Cp\u003EN\/A\u003C\/p\u003E\n\u003Ch3 id=\u0022summary-proposed-resolution\u0022\u003EProposed resolution\u003C\/h3\u003E\n\u003Cp\u003ETBD by Drupal Association and Drupal CNA team.\u003C\/p\u003E\n\u003Ch3 id=\u0022summary-remaining-tasks\u0022\u003ERemaining tasks\u003C\/h3\u003E\n\u003Cp\u003EDrupal Association\/Drupal CNA team to develop plan for how to ensure publication within the mandatory 72 hour window and preferably within 24 hour window.\u003C\/p\u003E\n\u003Ch3 id=\u0022summary-ui-changes\u0022\u003EUser interface changes\u003C\/h3\u003E\n\u003Cp\u003ENone\u003C\/p\u003E\n\u003Ch3 id=\u0022summary-api-changes\u0022\u003EAPI changes\u003C\/h3\u003E\n\u003Cp\u003ENone\u003C\/p\u003E\n\u003Ch3 id=\u0022summary-data-model-changes\u0022\u003EData model changes\u003C\/h3\u003E\n\u003Cp\u003ENone\u003C\/p\u003E","summary":"","format":"1"},"field_issue_status":"1","field_issue_priority":"200","field_issue_category":"5","field_issue_component":"Security Working Group (policy questions)","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/807766","id":"807766","resource":"node","machine_name":"securitydrupalorg"},"field_issue_files":[],"field_issue_related":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3582693","id":"3582693","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3479525","id":"3479525","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3479523","id":"3479523","resource":"node"}],"field_issue_version":"7.x-1.x-dev","field_issue_last_status_change":"1778695501","field_issue_parent_link":[],"field_issue_related_links":[{"url":"https:\/\/www.drupal.org\/node\/3582693","attributes":[],"display_url":null},{"url":"https:\/\/www.drupal.org\/node\/3479525","attributes":[],"display_url":null},{"url":"https:\/\/www.drupal.org\/node\/3479523","attributes":[],"display_url":null}],"flag_project_issue_follow_user":[{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/3611858","id":3611858,"resource":"user"},{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/1790054","id":1790054,"resource":"user"}],"nid":"3589998","vid":"14358914","is_new":false,"type":"project_issue","title":"Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4)","language":"en","url":"https:\/\/www.drupal.org\/project\/securitydrupalorg\/issues\/3589998","edit_url":"https:\/\/www.drupal.org\/node\/3589998\/edit","status":"1","promote":"0","sticky":"0","created":"1778695501","changed":"1779406986","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/1790054","id":"1790054","resource":"user"},"comment":"2","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16585981","id":16585981,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16590605","id":16590605,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16594579","id":16594579,"resource":"comment"}],"comment_count":"3","comment_count_new":false,"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":"2","has_new_content":null,"last_comment_timestamp":"1779406986"}