GitHub Can't Keep Up with the Surge in Vulnerability Reports

Post Views: 4

Across the open source world, software flaws are being reported at unprecedented rates, overwhelming the systems designed to validate and disseminate this information.

Record-breaking input across all channels

Private vulnerability reports increased from a few hundred per week in January to over 3,000 per week by mid-May. Repository advisories followed a similar trajectory, peaking at more than 5,000 per week. As a CVE Numbering Authority, GitHub processed nearly 4,000 CVE requests in May alone, a significant jump from the previous year. This trend reflects broader challenges beyond a single organization. The global CVE program has published over 30,000 entries in 2026, with private vulnerability reporting now spanning more than 1.7 million repositories.

Time constraints and operational strain

Since mid-April, publication delays have intensified. Initial review times stretched from a week to multiple weeks for a substantial portion of reports. Prolonged delays increase the risk of unpatched flaws remaining exposed. Madison Ficorilli, senior security manager leading the curation team, emphasizes that timeliness is critical to the database’s value. Not all advisories require equal effort. Some arrive with clear formatting, including precise package names, version ranges, and fix details, allowing rapid validation and publication. However, an increasing proportion demands deeper investigation, Ficorilli noted. This includes resolving conflicts between CVE records, maintainer notes, and code to determine affected components.

Madison Ficorilli, senior security manager leading the curation team, emphasizes that timeliness is critical to the database’s value.

Maintaining quality amid growth

The accuracy of published advisories remains intact. Data pipelines continue functioning, and all reviewed entries meet established standards. The CVE assignment rate fluctuated between 91 and 94 percent during the period, consistent with historical norms. GitHub has prioritized maintaining quality over accelerating publication, as faster processing could increase false positives.

Mitigation strategies

The curation team has integrated AI tools to expedite research phases, though human oversight remains mandatory. Backend capacity has expanded, triage processes have been refined to prioritize high-impact submissions, and automation has been enhanced to leverage upstream CVE records. Future efforts focus on reducing time spent on routine cases and prioritizing reports based on factors like active exploitation and package popularity.

Recommendations for researchers

Ficorilli advised researchers to focus on three key actions: submitting fully detailed vulnerability data, collaborating closely with maintainers and peers, and requesting CVEs only when disclosure is imminent. Coordination between maintainers and researchers ensures alignment on package names, version ranges, and fixes across sources. Limiting CVE requests to disclosures with clear publication plans allows curators to focus on advisories nearing release.

Future efforts

Two years ago, the database processed approximately 270 advisories monthly. The current growth aligns with broader trends toward open vulnerability disclosure, with GitHub committed to scaling its review infrastructure accordingly.

JSP webshells being dropped on unpatched PTC Windchill instances Mozilla warns of indirect prompt injection risk in AI coding agents DarkMoon: Open-source AI pentesting platform