NVD Concedes Inability to Keep Pace with Surging CVE Disclosures in 2025

stapp · Mar 30, 2025

The National Vulnerability Database (NVD) issued a new status update on March 19, attempting to clarify the current state of its vulnerability processing pipeline. The agency says it has resumed processing new CVEs at the same rate it maintained before last year’s slowdown, but with vulnerability volumes surging, that’s no longer enough.
Click to expand...

We are currently processing incoming CVEs at roughly the rate we had sustained prior to the processing slowdown in spring and early summer of 2024. However, CVE submissions increased 32 percent in 2024, and that prior processing rate is no longer sufficient to keep up with incoming submissions. As a result, the backlog is still growing.
Click to expand...

https://socket.dev/blog/nvd-backlog-crisis-deepens-amid-surging-cve-disclosures

stapp · Apr 6, 2025

The National Vulnerability Database (NVD)

Without much fanfare, the NVD has begun mass-labeling older CVEs as "Deferred," effectively giving up on enriching them with detailed metadata like CVSS scores, CWEs, and CPEs.
In an April 2 update, the NVD announced that all CVEs published before 2018 will be marked as Deferred—a move that's already resulted in 20,000 Deferred CVEs overnight, with potentially 100,000 more to come:
Click to expand...

“Deferred” = “We’re Not Doing It”
A CVE marked as Deferred won’t get the usual metadata that makes it useful to security teams. There’s no CVSS score, no CWE classification, no CPEs—no way to know how bad it is, what it affects, or what kind of vulnerability it represents.
Click to expand...

Seems like the backlogs are now totally out of hand.

https://socket.dev/blog/nvd-quietly-sweeps-100k-cves-into-a-deferred-black-hole

Log in or Sign up

NVD Concedes Inability to Keep Pace with Surging CVE Disclosures in 2025

stapp Global Moderator

stapp Global Moderator

Members

Useful Searches