54 reviewed advisories still carry a CVE ID that its CNA has rejected (census, 2026-11-01) #10831

Not GitHub staff. A census of this repo at commit 8c754a9 (2026-11-01), checked against the CVE List release cve_2026-11-01_1700Z, found 54 live GitHub-reviewed advisories whose only CVE alias has the state REJECTED. 41 of them were not modified after the rejection. The per-row table (GHSA, alias, CNA, rejection date and reason) is at https://github.com/munimtechnologies/advisory-import-census/blob/main/study/rejected-alias-s6/rows.csv and the write-up at https://github.com/munimtechnologies/advisory-import-census/blob/main/study/rejected-alias-s6/RESULTS.md

Three groups may be easier to handle together.

1. Ten Open WebUI advisories whose huntr CVEs were rejected on 2026-08-13 (one on 2026-08-31) with no further reason: GHSA-54f4-v6v9-9q82, GHSA-gv26-qw3h-8qvp, GHSA-c7fq-p62p-wvpc, GHSA-43g4-487m-5q6m, GHSA-gj27-76gq-5v3p, GHSA-ff5c-56m7-vc75, GHSA-85jc-8h5p-8vw8, GHSA-wcwp-9rcp-jvfg, GHSA-g3mx-83mp-3rwc, GHSA-chf7-q7m5-fq92. Five earlier ones were withdrawn in Withdraw GHSA-mq92-jr35-ffpc: source CVE-2024-7038 rejected by issuing CNA #8765 to Withdraw GHSA-x757-hv69-jr45: source CVE-2024-7959 rejected by issuing CNA #8769. Some of these ten list a real fix (for example GHSA-ff5c-56m7-vc75, fixed in 0.5.17), so the rejected ID alone may not mean the advisory should go; the maintainers would know.

2. Nine whose rejection reason says, in effect, that the issue is not a security issue. For example, these four say "Further investigation showed that it was not a security issue": GHSA-6f62-3596-g6w7 (webrick, CVE-2024-47220), GHSA-w66j-xc7r-m2jv (camel-ldap, CVE-2022-45046), GHSA-8pfj-w89w-m24x (zeppelin-shell, CVE-2024-31861) and GHSA-3mm3-wfpv-q85g (@clerk/clerk-js, CVE-2025-63700).

3. Six duplicate pairs of reviewed advisories, checked by hand: the rejection names the CVE that the second advisory already holds, for the same package with overlapping versions. GHSA-79jw-6wg7-r9g4 / GHSA-r5cq-9537-9rpf (mixme), GHSA-34rf-p3r3-58x2 / GHSA-g9cj-cfpp-4g2x (gradio), GHSA-p7v4-gm6j-cw9m / GHSA-98j2-3jv7-274m (mautic/core), GHSA-p3j6-f45h-hw5f / GHSA-xfjj-f699-rc79 (CHAOS), GHSA-8h5w-f6q9-wg35 / GHSA-7q94-qpjr-xpgm (langchain) and GHSA-h8hf-x3f4-xwgp / GHSA-f825-f98c-gj3g (mongoose). In each pair the first one holds the rejected CVE. GHSA-f7jh-m6wp-jm7f / GHSA-jhvj-f397-8w6q (hal-console) looks the same but lists different fixed versions.

One caution, from #10828: the ImageMagick maintainer did not want a CVE they had not requested added to their advisory. So a replacement CVE probably belongs only where the CNA itself names it (as in the duplicate cases), or where the maintainer agrees. I'm not opening pull requests for these rows. Corrections to the table are welcome.

Disclosure: the census and this note were made with AI agents working for MV2 of Munim, Inc. Code Apache-2.0, data CC BY 4.0.

MV2, Munim, Inc. (mv2@munimtech.com)