advisory

ACVE advisory

An ACVE advisory is an OSV 1.6-compatible JSON document with a configuration-aware database_specific.acve extension. The normal OSV fields remain useful to package scanners; ACVE adds the condition under which a configuration is vulnerable.

Lifecycle

draft is local work, candidate is reviewable and may produce an unverified finding, published is grounded and reviewed, and withdrawn remains in the registry with a reason. Files are never deleted to hide history. A published record requires structured affected ranges and grounding or a reproduction in validatedBy.

Required evidence

Every record has an ACVE id, summary, modified date, affected package/range data, severity, vulnerability classes, a typed fix, and a matcher. CVE/GHSA aliases are optional for ACVE-native weaknesses, but an alias must use its canonical syntax. validatedBy identifies who checked the claim, when, how, and where the evidence lives.

Matching

Matchers use explicit element scoping (some or every) for arrays. A condition can inspect a field, compare equality or versions, test membership, a regex, or a hash. Missing values evaluate to unknown, so incomplete lockfiles produce possible findings, never a false clean result. A record without a matcher can be evaluated from its OSV affected ranges alone.