Vulnerability Response Deadlines and VEX
This page is the canonical reference for response deadlines by CVSS severity. When the process and vulnerability chapters cover response deadlines, they use this table as the baseline and link here.
CVSS (Common Vulnerability Scoring System) expresses the severity of a vulnerability as a number between 0 and 10. Response deadlines are tiered by this score so that limited resources are used efficiently.
Response Deadlines by CVSS Severity
The Critical and High deadlines are the OpenChain KWG guide baseline. Because the KWG guide does not define deadlines for Medium and Low, those are trustedoss recommendations.
| Severity | CVSS score | Response deadline | Source | Action |
|---|---|---|---|---|
| Critical | 9.0~10.0 | Within 1 week | KWG baseline | Patch immediately or stop using |
| High | 7.0~8.9 | Within 4 weeks | KWG baseline | Establish a priority patch plan |
| Medium | 4.0~6.9 | Within 3 months | trustedoss recommendation | Include in the next release |
| Low | 0.1~3.9 | Next release | trustedoss recommendation | Register in the backlog |
Of the deadlines above, Critical and High are the KWG baseline. Organizations with a higher risk profile (finance, infrastructure, external delivery, etc.) can apply a stricter internal SLA.
Example: Critical within 24 hours / High within 1 week — patch immediately or consider suspending the service. If you set an internal SLA, document it in output/process/vulnerability-response.md and apply that deadline first.
VEX — Filtering Out CVEs That Do Not Affect You
Even when a component in an SBOM has a known CVE, the actual product is often not affected by that vulnerability (the vulnerable function is never called, the affected feature is unused, etc.). Treating every CVE the same way creates response noise.
VEX (Vulnerability Exploitability eXchange) is a standard artifact that states, for each CVE, whether this product is actually affected. Declaring "not affected" with a rationale lets you focus only on vulnerabilities that need action.
Key status values:
| Status | Meaning |
|---|---|
not_affected | Not affected (rationale required) — no action needed |
affected | Affected — act within the response deadline |
fixed | Already using a fixed version |
under_investigation | Investigating whether affected |
VEX is expressed in CycloneDX (the vulnerabilities field), OpenVEX, or CSAF, and is delivered along with the SBOM through the supply chain.
These criteria are foundational knowledge for the ISO/IEC 18974 §4.3.2 (vulnerability identification, assessment, and response) requirement.
Related Documents
- Vulnerability Analysis and Response chapter guide — scan CVEs with grype and OSV and respond within these deadlines
- Open Source Process chapter guide — document response deadlines as an in-house process
- Vulnerability Deliverable Best Practices — completed CVE report and remediation plan examples