{"data":{"repository":{"discussion":{"title":"CVE not assigned for 24 days?","url":"https://github.com/orgs/community/discussions/205706","comments":{"nodes":[{"createdAt":"2026-08-24T15:47:55Z","author":{"login":"justin24er"},"body":"Ok!, 24 days is well beyond the stated \"up to 3 working days\" window, so this is worth flagging directly rather than assuming it's just a busy queue, that SLA is documented as the norm, not a best-case.\r\n\r\n**A couple of practical notes:**\r\n\r\n- GitHub's CVE request queue (as a CNA) can genuinely back up during high-volume periods, but 3+ weeks with zero movement usually means something's stuck, not just slow, worth checking your draft advisories for any pending action needed on your end (sometimes a CVE request stalls silently if additional info was requested and missed).\r\n\r\n- Only GitHub staff can actually verify queue status for specific repos like `compliance-trestle`, community can't look that up, so this needs to go through [GitHub Support](https://support.github.com) rather than Discussions for a real answer.\r\n\r\nWhen you file it, reference the specific advisory IDs/draft URLs and the exact request dates, that gives them something concrete to trace rather than a general \"queue is slow\" report, and mention the doc's 3-day claim directly since that's a fair ask for them to either honor or correct."},{"createdAt":"2026-08-24T16:06:18Z","author":{"login":"degenaro"},"body":"I'm not sure where to look for pending action required. Here is all that I see: [degenaro](https://github.com/degenaro) requested a CVE [3 weeks ago](https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-6g77-m44c-hmc5#event-886835). \r\n\r\nI will file an issue with GitHub Support as you suggest."},{"createdAt":"2026-09-05T14:57:39Z","author":{"login":"wu21-web"},"body":"I met the same situation, I have been waiting for over a week, which is very slow for security responses."},{"createdAt":"2026-09-08T06:24:42Z","author":{"login":"soumyaa308"},"body":"1.Have a maintainer/advisory admin (only they can inspect the CVE request status) open the draft advisory and confirm the CVE field still shows \"pending.\"\r\n2.Open a support ticket at https://support.github.com/contact under a security-advisory/CVE-related category — Free-tier accounts can still contact Support for security-related issues, not just paid tiers.\r\n3.In the ticket, reference the GHSA numbers and original request dates directly rather than resubmitting — duplicate/repeated requests are flagged as a possible validation failure and can complicate the audit trail rather than speed things up.\r\n4.Don't include embargoed vulnerability details in the public ticket."},{"createdAt":"2026-09-08T23:19:07Z","author":{"login":"ghostinhershell"},"body":"Hey @degenaro, \r\n\r\nEchoing the update to your ticket, _due to a [significant increase](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/) in CVE publication requests across the industry, we're currently processing records in the order they're received, with a turnaround of approximately five weeks._\r\n\r\nFeedback around updating our turnaround time was passed along to our curation team. If you have any additional questions, please feel free to update this discussion and let us know. Thanks!"}]}}}}}