Rejected is a CVE state meaning the ID should no longer be used. Withdrawn is how OSV and GitHub mark an advisory they retracted. Disputed means someone contests a claim while the record stays live. Hide the first two from active findings, and review the third.
The labels side by side
| Label | Where it appears | Meaning |
|---|---|---|
| Rejected | CVE record state | The CVE ID and record should no longer be used. It stays on the list so users can see it is invalid. |
| Withdrawn | OSV withdrawn field, GitHub is:withdrawn filter | The entry was retracted. In OSV, no withdrawn value means it has not been withdrawn. |
| Disputed | A tag on a CVE record | One party disagrees with another party's assertion that an issue is a vulnerability. See what disputed means. |
Source detail
The CVE record format says a rejected record remains on the list, and the rejected container can carry a replacedBy list of IDs. So a rejection is sometimes a merge, not a deletion of the problem. The OSV schema defines withdrawn as the time an entry was withdrawn. GitHub's browsing page lists is:withdrawn as a qualifier. The Go database also excludes some reports for reasons including NOT_A_VULNERABILITY and WITHDRAWN.
What to do with each
- Rejected: remove from findings. If
replacedBylists IDs, check that those IDs are in your scan, because the real flaw may live under them. - Withdrawn: remove from findings, and close any ticket raised on it with a note.
- Disputed: keep, read the dispute, decide whether it applies to your use, and record the decision.
A worked decision
Say a ticket exists for an advisory that is now marked withdrawn. Check three things. Was it a duplicate of another advisory? If so, confirm the other one is tracked. Was it withdrawn because the package was never vulnerable? Then close it. Was it replaced by a rejected and re-filed ID? Then follow the replacement.
Why scanners disagree here
A tool that loads the full OSV export without reading the withdrawn field will report retired records. A tool that drops anything it cannot match may hide a record that was only reworded. Our post on why scanner counts differ covers the wider picture, and withdrawn duplicate GitHub advisories shows real cases.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings move between open and closed states with a recorded reason.
Safeguard supports vulnerability management with policies and gates, and its SBOM and dependency scanning feeds the list. Try a free scan.
Quick check
Is a rejected CVE deleted?
No. It stays on the list marked rejected so people can tell it is invalid.
Should I ignore every disputed CVE?
No. Disputed records remain live. Read the dispute and record your decision.
Sources
- CVE Record Format JSON schema
- CVE record CNA tags
- OSV schema
- Browsing the GitHub Advisory Database
- Go vulnerability database documentation
Last reviewed: 19 October 2026.
