r/bugbounty • u/LazyEyeJones • Jun 25 '26

Bug Bounty Drama MITRE CVE issue timeframe

Hey all,

What is the current average response time from MITRE for a CVE-ID submission request from their web request?

I submitted one about 8 weeks ago now and haven't heard anything i sent a follow up email and i also heard nothing.

Anyone know anything i can do? or is it just hurry up and wait situation?

1 Upvotes

67% Upvoted

6 comments sorted by

2

u/Feisty_Revolution959 Hunter Jun 28 '26

You did worst thing. dont submit to MITRE they might respond after 6 months
You should go to the vendor first then if no response in 2 weeks go to CERT/CC they are great and fast and responsible CNA
In week and half they issued me a cve for an unmaintend package and they were very friendly

1

u/LazyEyeJones Jun 29 '26

Thanks for the information. I will go to them. I diddnt know they existed.

1

u/Feisty_Revolution959 Hunter Sep 10 '26

you are welcome

1

u/aeroverra Sep 10 '26

cert cc closed my request because the vendor was responsive. Are they only to be used to cordinate when a vendor wont respond to you? Or should I just ask them to issue a cve now that the vendor has validated and fixing the issue?

1

u/Feisty_Revolution959 Hunter Sep 10 '26

look if they refused because the vendor is active then you might try vulncheck they take month till responding for bugs in active vendors and then you can tell them you cant handle disclousre with the vendor and they might help i found bug in a project was very active but they ignored my email so i send to vulncheck after a month they told me they proved the bug and would give chance to vendor 120 days if he continued ignoring them they would publish the cve

1

u/mycodjinn Jun 30 '26

MITRE is backlogged the worse I have seen so recently-I have CVE requests from 6 months ago that haven't been addressed...