Skip to main content
CSAF
Dashboard
CSAF
Import
Export
Settings
Theme
Theme
System
Light
Dark
Apply
Language
English
Deutsch
Français
Español
Italiano
Shqip
Հայերեն
Azərbaycanca
Беларуская
Bosanski
Български
Català
中文
Hrvatski
Čeština
Dansk
Nederlands
Eesti
Suomi
ქართული
Ελληνικά
हिन्दी
Magyar
Íslenska
Gaeilge
Latina
Latviešu
Lietuvių
Julevsámegiella
Lëtzebuergesch
Македонски
Malti
Crnogorski
Davvisámegiella
Norsk bokmål
Norsk nynorsk
Polski
Português
Română
Rumantsch
Русский
Српски
Slovenčina
Slovenščina
Åarjelsaemien gïele
Svenska
Türkçe
Українська
اردو
Info
About
License
System Info
Privacy
Security
Changelog
README
Administrator Guide
User Guide
Edit ndaal-sa-2026-073
Document Metadata
Tracking ID *
Title *
Category *
Security Advisory
VEX
Informational Advisory
Status *
draft
interim
final
Document Version *
TLP 2.0 *
TLP:CLEAR
TLP:GREEN
TLP:AMBER
TLP:AMBER+STRICT
TLP:RED
Verschlusssache
VS-NfD (VS-NUR FÜR DEN DIENSTGEBRAUCH)
VS-Vertr. (VS-VERTRAULICH)
Geh. (GEHEIM)
Str. Geh. (STRENG GEHEIM)
NATO
NR (NATO RESTRICTED)
NC (NATO CONFIDENTIAL)
NS (NATO SECRET)
CTS (COSMIC TOP SECRET)
Initial Release Date *
Current Release Date *
Summary *
The CSAF data model in ndaal_public_csaf_crud (the `csaf-models` crate, consumed by `csaf-core` / `csaf-crud` / `ndaal-csaf-cli`) serialized the CVSS v4.0 metric object using CVSS v3.1 property names. The `CvssV4` struct's vulnerable-system impact fields were emitted as `confidentialityImpact` / `integrityImpact` / `availabilityImpact` (the CVSS v3 names) instead of the CVSS v4 names `vulnConfidentialityImpact` / `vulnIntegrityImpact` / `vulnAvailabilityImpact`. As a result, any advisory the application serialized or exported that carried a CVSS v4 score produced a `cvss_v4` object that violates the CSAF 2.1 JSON schema (the embedded CVSS 4.0 schema sets `unevaluatedProperties: false`), so strict CSAF consumers reject the document. The CVSS vector string and base score were correct; only the structured property names were wrong. Fixed in 0.3.4 by renaming the three serde fields to the correct CVSS 4.0 names and enabling an on-by-default OASIS conformance gate on export.
Publisher
Name *
Namespace *
Category *
vendor
discoverer
coordinator
user
translator
other
Contact details
Affected Product
Vendor *
Product Name *
Product ID *
Product Status *
known_affected
known_not_affected
fixed
under_investigation
Vulnerability
Required for Security Advisories, optional for Informational / VEX.
CVE ID
Vulnerability Title
Vulnerability Description
ndaal_public_csaf_crud before 0.3.4 serialized the CVSS v4 metric of exported CSAF advisories using CVSS v3 JSON property names instead of the CVSS 4.0 vulnerable-system names (vulnConfidentialityImpact / vulnIntegrityImpact / vulnAvailabilityImpact) and the subsequent-system Sub* names. The resulting cvss_v4 object is non-conformant with the OASIS CSAF 2.1 schema and may be rejected by strict consumers. This is a data-conformance defect in produced advisory artefacts; it has no confidentiality or availability impact on the application or host. Fixed in 0.3.4, which emits cvss_v4 with the correct property names and gates export/import on the OASIS CSAF 2.1 schema suite; re-export any advisory that carries a CVSS v4 score.
CWE ID
CWE Name
CVSS v3.1
Base Score (0.0 – 10.0)
Severity
—
NONE
LOW
MEDIUM
HIGH
CRITICAL
CVSS v3.1 Vector
CVSS v4.0
Base Score (0.0 – 10.0)
Severity
—
NONE
LOW
MEDIUM
HIGH
CRITICAL
CVSS v4.0 Vector
Save Changes
Cancel
Are you sure?
Cancel
Confirm