A disputed tag on a CVE record means one party disagrees with another party's claim that the issue is a vulnerability. Typically the reporter says it is a flaw and the vendor says it is intended behavior. The tag records the disagreement. It does not say who is right, so you still have to judge.
What the schema says
The CVE Project's tag list defines disputed as being used when one party contests another's claim that an issue is a vulnerability. The record for that issue may then be tagged as disputed. The same tag exists for CNA containers and for additional-data containers, so the dispute can be flagged by the assigning CNA or by another organization that adds data to the record.
Common shapes of a dispute
| Reporter says | Vendor says |
|---|---|
| This input should be rejected | Callers are responsible for validation |
| This default is unsafe | The setting is documented and configurable |
| An attacker with local admin can do harm | That attacker already has full control |
Some disputes are fair on both sides. Others are a product team avoiding work. The tag alone cannot tell you which.
How to act when your scanner shows one
- Open the record and read both statements. The description often names the vendor position.
- Ask whether the vendor's assumption holds in your deployment. If your service exposes the function to untrusted callers, their assumption fails for you.
- Check reachability: does your code call the affected path at all? Reachability analysis answers that faster than an argument does.
- Record your decision with the reason and a review date. If you accept the vendor view, write that down, so an auditor sees a decision rather than a missing ticket.
If you are the vendor receiving a report you disagree with
Say so politely, in writing, with the design reasoning. Offer to document the assumption in your security guidance. Ask the reporter whether they would accept a disputed note on the record instead of a public fight. The triage guide for maintainers walks through the questions.
Avoid the temptation to reject quietly. Reporters who feel ignored publish, and an explained position holds up better than silence.
Try it yourself
Click through it at your own pace, or open it full screen.
Step through the check and notice how the answer depends on your own deployment, not on the label.
Quick check
Is a disputed CVE safe to ignore?
Not automatically. The tag marks a disagreement. Decide using your own exposure and record the reason.
Who can add the disputed tag?
The schema provides it for both the assigning CNA's container and additional-data containers, so more than one organization can flag it.
Safeguard's reachability analysis helps show whether a flagged component is actually used by your code. Try a free scan.
Sources
Last reviewed: 19 October 2026.
