What does defaultStatus unknown mean in a CVE record?

In a CVE record, defaultStatus is the status to assume for versions the record does not list. If the field is not given, it defaults to unknown. Unknown means the record makes no claim, so a version outside the listed ranges is not proven safe.

What the schema says

The CVE record format describes defaultStatus as the default status for versions not otherwise listed in the versions list, and says it defaults to unknown when unspecified. It adds that versions or defaultStatus may be omitted, but not both. So every record says something, even if it says very little.

The status values the format uses are affected, unaffected and unknown. The schema says unknown can have many causes, including that an investigation has not been undertaken or that a vendor has not disclosed the status.

How a range is described

Versions in the record can be a single version or a range. Per the schema:

• version is the single version or the start of a range, and by convention 0 means the earliest possible version.
• lessThan is the non inclusive upper limit, the least version not in the range.
• lessThanOrEqual is the inclusive upper limit. Only one of the two should be given.
• changes lists status changes inside the range, and clients must sort the list themselves.
• versionType says which numbering system defines the comparison, such as semver or maven. The value custom means unspecified and should be avoided.

A trailing asterisk is allowed, so a range can describe a whole branch such as 1.x.

Why unknown causes trouble

Take a record that lists one affected range, below 2.4.1, and leaves defaultStatus as unknown. Version 3.0.0 is not listed. Is it affected? The record does not say. A scanner that treats unlisted as safe will stay quiet, and one that treats unlisted as affected will alert. Both are guesses.

What to do as a reader

1. Read defaultStatus first, then the versions list.
2. Check versionType. If it is custom, do not trust automated comparison.
3. For versions outside the listed ranges and with an unknown default, read the vendor advisory.
4. If the vendor states a supported version line and the fix, use it.
5. If still unclear, test a build on the fixed version and the one before.
6. Record that the status was unknown and how you resolved it.

For the writer's side, see how to write affected versions in a CVE record, and for range semantics in OSV see introduced and fixed.

Try it yourself

Click through it at your own pace, or open it full screen.

Look at the exact version recorded for each component. That is the value compared with the ranges.

Safeguard SBOM and dependency scanning records exact component versions for this comparison. You can start with a free scan.

Quick check

Sources

• CVE Record Format JSON schema

Last reviewed: 19 October 2026.