In CSAF 2.0, status tells readers whether an advisory is still being worked on. Draft means not yet released. Final means published. Integer versions increment for each version with status final, and version 0 requires status draft. A document must use only one versioning system.
Where these fields live
CSAF is the OASIS Common Security Advisory Framework, an OASIS Standard dated 18 November 2022. Inside the document, a tracking section holds aliases, current release date, generator, ID, initial release date, revision history, status and version.
These fields answer the questions a customer has on opening an advisory: is this finished, which version am I reading, and when did it last change?
What the specification confirms
From the part of the specification we reviewed:
- Status values we confirmed in the text include draft and final.
- Integer versioning increments for each version where the status is final.
- Version 0 requires status draft.
- A CSAF document must use only one versioning system, so you pick integer or semantic versioning and keep it.
The excerpt we read did not list every allowed status value, so check the full specification for the complete set before you build tooling around it.
Practical use
| Situation | Status | Version |
|---|---|---|
| Internal writing, not yet released | draft | 0 |
| First public release | final | 1 |
| Correction after release | final | 2 |
| Further update | final | 3 |
Draft versions are for work in progress. Do not publish a draft to customers as if it were settled, because tools may treat it as incomplete.
Steps to adopt a clean flow
- Write the advisory with status draft and version 0 while engineering and legal review.
- On approval, change status to final and set version 1, with the initial release date.
- For each later change, add an entry to the revision history and increase the version.
- Update the current release date every time.
- Make sure the human readable page shows the same version and date.
- Validate the file against the schema before every release.
Why consistency matters
Customers and their tools compare advisories over time. If your version numbers jump, repeat or change style, they cannot tell what changed. A single versioning system and a revision history that matches the page give them a reliable timeline. For the communication side, read our post on correcting a published advisory.
Quick check
Can version 0 be final?
No. The specification says version 0 requires the document status to be draft.
Can I mix integer and semantic versioning?
No. A CSAF document must use only one versioning system.
Safeguard's SBOM and dependency scanning help vendors keep the product data behind an advisory current. There is a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
