FAQ

What is a GVD?

A Gravwell Vulnerability Disclosure is a security advisory for our product and services Gravwell uses. Each one has an ID of the form GVD-YYYY-NNNN and covers one or more vulnerabilities, each named by its CVE ID where it has one.

Is my version affected?

Use the “Am I affected?” check on the home page, or open the release pages, which list the advisories each release fixes. Each advisory also lists the versions it affects.

Will you backport a fix to my release?

No. Only the latest Gravwell release gets security fixes. To fix a vulnerability, upgrade to the release its advisory names. See the policy.

I use Gravwell Cloud. Do I need to do anything?

Each advisory has a Gravwell Cloud section that says what we did and whether you need to act. We upgrade Gravwell Cloud as one fleet.

What does “Gravwell’s assessment” mean?

We score each vulnerability ourselves, as it affects Gravwell, with CVSS 4.0 and CVSS 3.1. For third-party vulnerabilities our score can differ from the upstream one, which the advisory links to.

Why do advisories have two CVSS scores?

CVSS 4.0 is the main score. CSAF 2.0, the machine-readable format we publish, only supports CVSS 3.1, so each scored vulnerability has both. When CSAF 2.1 stabilizes, we will drop support for CVSS 3.1 scores.

Are advisories available in a machine-readable format?

Yes. We also publish each advisory as a signed CSAF 2.0 document. Each advisory page links to its CSAF document at the top.

How do I get advisories automatically?

Point a CSAF 2.0 tool at provider-metadata.json, or read index.json. We sign the documents with the key on the report page.

How do I verify a CSAF document?

Download the document with its .sha512 and .asc files. Check the hash, then verify the signature with our public key:

sha512sum -c gvd-2026-0001.json.sha512
gpg --verify gvd-2026-0001.json.asc gvd-2026-0001.json

My question isn’t answered here

Email the Gravwell Security Team at security@gravwell.io.