# Gravwell Security Advisories

> Security advisories for Gravwell and the upstream components it ships: which versions each vulnerability affects, what Self-Hosted and Gravwell Cloud customers need to do, and how to report a vulnerability. Every advisory is also a signed CSAF 2.0 document.

Advisories have IDs of the form GVD-YYYY-NNNN, and each covers one or more vulnerabilities. Only the latest Gravwell release gets security fixes: upgrading to the release an advisory names is the remediation. Scores are Gravwell-assessed CVSS 4.0, with CVSS 3.1 alongside.

## Advisories

- [GVD-2026-0001: Compromised eMudhra intermediate CAs in Go crypto/x509](https://security.gravwell.io/advisories/GVD-2026-0001/): Critical. CVE-2026-111943. Fixed in 5.10.3. Published 2026-10-29, updated 2026-10-29. Markdown: https://security.gravwell.io/advisories/GVD-2026-0001/index.md CSAF: https://security.gravwell.io/.well-known/csaf/white/2026/gvd-2026-0001.json

## Machine-readable data

- [index.json](https://security.gravwell.io/index.json): every advisory with its vulnerabilities, statuses, and introduced and fixed versions
- [CSAF provider metadata](https://security.gravwell.io/.well-known/csaf/provider-metadata.json): CSAF 2.0 trusted provider; documents, hashes and signatures are under https://security.gravwell.io/.well-known/csaf/white/
- [security.txt](https://security.gravwell.io/.well-known/security.txt): contact details (RFC 9116), cleartext-signed

## Policy and reporting

- [Vulnerability disclosure policy](https://security.gravwell.io/policy/): scope, testing rules, response timelines and supported releases
- [Report a security vulnerability](https://security.gravwell.io/report/): email security@gravwell.io, encrypted with the PGP key if sensitive
- [FAQ](https://security.gravwell.io/faq/): common questions about advisories, scores and CSAF
- [PGP key](https://security.gravwell.io/pgp-key.asc): Gravwell Security Team key, fingerprint 3D6EB8028BC573DE47A594108F935E9306678D59; its signing subkey C0B089FD04B24E98B89E09E49A332866229E9706 signs security.txt and the CSAF documents

## Optional

- [Release pages](https://security.gravwell.io/releases/): advisories fixed in each Gravwell release
- [Acknowledgments](https://security.gravwell.io/acknowledgments/): researchers credited for reports