diff options
| author | Roland Shoemaker <roland@golang.org> | 2026-03-20 12:39:02 -0700 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2026-03-20 14:14:19 -0700 |
| commit | 48a89e357810977702866cbdc0a779c8a54d94d3 (patch) | |
| tree | ce5788e7c499bed72d818a0eda994e47040f2587 | |
| parent | 3e7a36915b2fd47cc8655929bc341423b8410ddf (diff) | |
| download | go-x-website-48a89e357810977702866cbdc0a779c8a54d94d3.tar.xz | |
_content/doc/security: explain why no CVSS
Change-Id: Ia63c0c1cb78adc42526af70628442d33cff7a1ad
Reviewed-on: https://go-review.googlesource.com/c/website/+/757301
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Neal Patel <nealpatel@google.com>
| -rw-r--r-- | _content/doc/security/policy.md | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/_content/doc/security/policy.md b/_content/doc/security/policy.md index f0fa180f..c7249034 100644 --- a/_content/doc/security/policy.md +++ b/_content/doc/security/policy.md @@ -42,7 +42,12 @@ issues will be issued CVE numbers. The Go Security team does not assign traditional fine-grained severity labels (e.g CRITICAL, HIGH, MEDIUM, LOW) to security issues because severity depends -highly on how a user is using the affected API or functionality. +highly on how a user is using the affected API or functionality. Additionally, +when issuing CVEs for Go security issues we do not assign CVSS scores, as we +fundamentally disagree with the applicability of the scoring system to Go for +the same reasons. Third parties, such as MITRE or NIST, via the NVD, may assign +CVSS scores to our vulnerabilities, but we do not endorse these scores as +accurate reflections of their impact. For example, the impact of a resource exhaustion issue in the `encoding/json` parser depends on what is being parsed. If the user is parsing trusted JSON |