Confusing CVE Alerts for Bug Severity

“Libxml2's "no security embargoes" policy An AV system stopping because of a bug in a library is bad, but that&#x27;s not because the library has a security bug. It&#x27;s a security problem because the system itself does security. It would be wild if any bug that leads to a crash or a memory leak was a &quot;security&quot; bug because the library <i>might have been used</i> by someone somewhere in a context that has security implications.<p>A bug in a library that does rate limiting arguably <i>is</i> a security issue because the library itself promises to protect against abuse. But if I make a library for running Lua in redis that ends up getting used by a rate limiting package, and my tool crashes when the input contains emoji, that&#x27;s not a security issue <i>in my library</i> if the rate limiting library allows emails with punycode emoji in them.<p>&quot;Hogging all of the resources on a shared system&quot; isn&#x27;t a security bug, it&#x27;s just a bug. Maybe an expensive one, but hogging the CPU or filling up a disk doesn&#x27;t mean the system is insecure, just unavailable.<p>The argument that downtime or runaway resource use due is considered a security issue <i>but only if the problem is in someone else&#x27;s code</i> is some Big Brained CTO way of passing the buck onto open source software. If it was true, Postgres autovacuuming due to unpleasant default configuration would be up there with Heartbleed.<p>Maybe we need a better way of alerting downstream users of packages when important bugs are fixed. But jamming these into CVEs and giving them severities above 5 is just alert noise and makes it confusing to understand what issues an organization should <i>actually</i> care about and fix. How do I know that the quadratic time regexp in a string formatting library used in my logging code is even going to matter? Is it more important than a bug in the URL parsing code of my linter? It&#x27;s impossible to say because that responsibility was passed all the way downstream to the end user. Every single person needs to make decisions about what to upgrade and when, which is an outrageous status quo.”