Contact the CNA that assigned the ID, give your evidence, and ask for a review. If the parties still disagree, a record can carry a DISPUTED tag, which tells readers there is a disagreement without the CVE Program deciding who is right. Do not ignore the record, because customers will see it.
Start with why you disagree
Before you write to anyone, be honest about the reason. There are only a few:
| Your position | What to gather |
|---|---|
| The behavior is documented and intended | Docs, design notes, release history |
| The claimed attack needs conditions that do not exist | A reproduction showing the attack fails by default |
| The issue is real, but the severity is overstated | Your CVSS vector with assumptions |
| It is a duplicate of another ID | The earlier ID and the shared root cause |
| It affects a different product or version than listed | A version matrix |
If you can reproduce the issue, you may be in the wrong. See how to reproduce a report safely first.
What the CVE Program says
The CVE FAQ explains the DISPUTED tag. When one party disagrees with another's assertion that a particular issue is a vulnerability, the record assigned to that issue may be marked DISPUTED. The program says it makes no determination about which party is correct. The tag lets readers see that a potential vulnerability exists and weigh the dispute themselves. It points to section 4.6 of the CNA rules and a dedicated policy and procedure for disputing a CVE record.
A record marked REJECTED is different. It is not accepted as a CVE record, for example because it is a duplicate, was withdrawn by the requester, or was assigned incorrectly. Rejected records stay on the list so users know the ID is invalid.
If a CNA turns down a request and the requester believes the reason was not valid, the CVE FAQ says to appeal to a CNA of Last Resort.
Steps
- Talk to the researcher first. Many disputes are misunderstandings. A short call or message can fix it.
- Write a clear rebuttal. Facts, versions, steps, and your reasoning. Avoid heat.
- Contact the assigning CNA with your evidence and request a review. The CVE Program's dispute procedure applies.
- Ask for the right outcome. A correction, a different scope, a DISPUTED tag, or a rejection.
- Prepare customer wording. Publish your position on your security page so customers who see the record find your explanation.
- Record the decision in the case file.
Do not do this
- Do not threaten the researcher.
- Do not insist the record disappears when the facts are mixed.
- Do not change your documentation retroactively to fit your argument.
- Do not leave customers guessing.
Think about the cost
A fight may keep a record visible longer than a quick fix and a clear note. If a small hardening change removes the objection, consider making it even if you think the original claim was weak. You can say so in the advisory.
When the record is right, but your scoring differs
That is common, and it is not a dispute about existence. Use the approach in re-scoring a researcher's severity.
Tools
For issues in a library you ship, Safeguard's reachability analysis can show whether your code calls the affected function, which is useful evidence in a dispute about real exposure. A free scan is available.
Quick check
Does DISPUTED mean the CVE is false?
No. It means someone disagrees. The program does not rule on who is correct.
Can I remove a CVE I do not like?
Only through the CNA process, and only if the record is wrong in a way the rules recognize. Your evidence matters.
Sources
Last reviewed: 19 October 2026.
