A published CVE record in the CVE Record Format has four required parts inside the CNA container: provider metadata, descriptions, affected products and references. Everything else, including credits, workarounds, solutions, timeline and metrics, is optional. Fill the optional ones anyway, because they decide whether a reader can act.
The envelope
Every record has a data type (always CVE_RECORD), a data version for the schema, a metadata block, and containers. The metadata block holds the CVE ID, the assigning organization, the state, and optional dates. Containers hold the actual vulnerability information, one per contributing source. The CNA container is required. Additional-data containers from other organizations are optional.
Required versus useful
| Field | Required in a published record | Why it matters |
|---|---|---|
| providerMetadata | Yes | Says who wrote the record |
| descriptions | Yes | The plain language summary |
| affected | Yes | Products and versions |
| references | Yes | Links to the advisory, fix, patch |
| problemTypes | No | Weakness classes, often CWE |
| metrics | No | Severity scores |
| credits | No | Who found or fixed it |
| workarounds | No | Mitigations when you cannot patch |
| solutions | No | The fix or remediation |
| configurations | No | Settings needed to be exposed |
| timeline | No | Dated events from report to fix |
The required list comes straight from the schema. The usefulness column is our judgment.
Writing the description well
Say what the flaw is, which component, which condition, and the impact in one or two sentences. Avoid marketing words. A good test: could an engineer decide whether they are exposed from the description alone, without opening a link?
Fields that save your customers time
- Configurations: if the flaw only matters with a non-default setting, say so here. It removes a lot of false alarms.
- Workarounds and solutions: each is a list of descriptions, so you can give both an interim step and the permanent fix.
- Timeline: dated entries for report, fix and publication build trust with researchers and auditors.
- Problem types: a CWE reference lets tools group your issue with similar ones. See CVE versus CWE.
Keep it consistent with your own advisory
The record should match your public advisory, not contradict it. If you use a template, map your advisory sections to these fields once and reuse the mapping. Our advisory template fields post gives a starting layout.
Quick check
Are credits required in a CVE record?
No. The field is optional in the schema, but leaving it out removes the public thanks that keeps researchers reporting to you.
Can other organizations add data to my record?
Yes. The schema allows optional additional-data containers beyond the CNA container.
Safeguard's compliance and evidence automation can keep your advisory steps recorded alongside your policies. You can also run a free scan to see how your dependencies appear in advisory data.
Sources
Last reviewed: 19 October 2026.
