oss-security is a public mailing list for discussing security issues in open source software. Dependency owners can read it for early public detail on issues, but it is not a complete feed, so use it alongside advisories and release notes, not instead of them.
What the charter says
The list's own charter states its purpose: to encourage public discussion of security flaws, concepts and practices in the open source community. Members include projects, distributors, researchers and developers. Anyone can subscribe, and new posters are moderated to keep discussion on topic.
Several rules shape what you will see:
- Subjects should name the affected software, versions and vulnerability type.
- The essential detail must be in the message body, not only behind a link.
- Issues posted must already be public or be made public by the post.
- Advisories aimed only at end users, such as a distribution announcing new packages, are not welcome.
- It is about open source software, not closed source products.
A read-only archive is public, with an RSS feed available through one of the archive mirrors named on the charter page.
What this means for a consumer
Because posts must be public by the time they appear, the list is a place for disclosure, not for early warning. For an upcoming fix, an announce list like those described in our guide to where maintainers announce security fixes is usually earlier.
The subject line rule helps you scan. You can skim a day of subjects for package names you use and ignore the rest.
Because the end user advisory exclusion exists, you will not see a stream of "we shipped new packages" messages. That keeps volume lower but means the list is thin on distribution specific news. For that, follow your distribution's own channels.
A practical way to use it
- Subscribe a shared mailbox or use the archive RSS feed in a reader.
- Set a filter on the names of your most exposed runtimes and libraries.
- When a match appears, read the message, not only the link.
- Look up the package in your inventory.
- Open a ticket if a version you run is in the affected range.
Plan on ten minutes a day at most. If that is too much, check twice a week and rely on automated matching for the rest.
Cautions
- A post is a person's account of an issue. It may be corrected later in the thread.
- A CVE ID might not exist yet. The charter notes that CVE requests are made after the issue is public, then the poster replies with the ID.
- Do not treat silence as safety. Many fixes never appear on the list.
Where Safeguard fits
Safeguard matches published advisories to your SBOM so you do not depend on skimming lists. Try a free scan at gold.safeguard.sh/scan.
Quick check
Can I post a new vulnerability to oss-security before telling the maintainers?
The charter says issues posted must already be public or be made public by the post. Coordinate with the maintainers first unless public disclosure is intended.
Is oss-security enough to catch every open source advisory?
No. It is one public channel and excludes some announcement types, so combine it with advisories, release notes and automated scanning.
Sources
Last reviewed: 19 October 2026.
