Vulnerability states

Every vulnerability entry has a state that reflects where it sits in the triage lifecycle. State is not written into the YAML directly; it is derived from the entry’s verdict, disposition, and resolution fields each time a report is generated.

The states

State Derivation Meaning

under investigation

no verdict

The finding has been registered but triage has not concluded.

open

verdict is affected, no resolution, disposition is not wont fix

Triage is complete and the vulnerability impacts the project. The entry awaits a fix.

accepted

verdict is affected with disposition: wont fix, no resolution

Triage is complete, the vulnerability impacts the project, and the project decided not to remediate. The risk is live and deliberately carried.

resolved

resolution recorded

A resolution has been recorded for the entry. The maintainer’s triage work is complete.

not applicable

verdict is not affected, no resolution

Triage concluded that the vulnerability does not impact the project. Nothing is carried and nothing is owed.

accepted and not applicable are separate states on purpose. A not affected verdict is an objective claim about the code, and it carries no risk. A wont fix disposition is a subjective decision that leaves a real risk in the product. Reporting them under one label would hide the entries that deserve the most scrutiny among the entries that deserve the least.

Derivation precedence

The rules are evaluated in this order:

  1. If no verdict is recorded, state is under investigation.

  2. Otherwise, if a resolution is recorded, state is resolved (regardless of verdict).

  3. Otherwise, state is derived from the verdict and disposition: affected yields open, unless disposition: wont fix makes it accepted; not affected yields not applicable.

Terminal states

resolved, accepted, and not applicable are all terminal, but they are not equivalent.

resolved means a resolution was recorded: a fix, or a hygiene update on a not affected entry. not applicable means the entry was closed because the vulnerability never impacted the project. accepted is terminal only by decision, not by fact. It is the one terminal state that still carries live risk, and the decision behind it is revocable: change the disposition and the entry returns to open. Treat accepted entries as a standing review list rather than as closed work.

A not affected entry that later records a hygiene update moves from not applicable to resolved and appears in the Fixed In column.

Perspective

By default, state describes the maintainer’s view: has the triage team finished its work on this entry? It does not describe whether a currently running release contains the fix, so an entry can be resolved while the release carrying the fix is still unpublished.

When --as-of X is supplied to vulnlog report impact or vulnlog suppress, state shifts to a release-scoped view: a resolution only counts when its target release ships at-or-before X. A resolution pointing at a later or unpublished release is ignored for state classification, so the entry falls back to the state derived from its verdict and disposition (open for affected, accepted for affected with disposition: wont fix, and not applicable for not affected). The Fixed In column (the entry’s resolution.in field) still shows the recorded fix release for reference.

Typical progression

  1. New entry. No verdict. State is under investigation.

  2. Triage complete. verdict set.

    • Verdict affected: state is open, awaiting a fix.

    • Verdict affected with disposition: wont fix: state is accepted. The risk is carried without remediation.

    • Verdict not affected: state is not applicable. No further action is required.

  3. Closure. resolution recorded. State is resolved regardless of verdict. The verdict is retained.

State in the HTML report

The HTML report produced by vulnlog report impact is the project owners view (the view from and for the project maintainer team) of the triage backlog across all tracked releases. Entries in every state appear in the same table so the maintainer can see the complete picture.

Column Content

State

under investigation, open, accepted, resolved, or not applicable.

Releases

Releases in which the vulnerability was reported.

Fixed In

Release in which the resolution was recorded. Empty for entries that are not resolved.

The summary above the table breaks the entries down by state, then by severity for the open entries and again for the accepted entries. The second breakdown is the list of risks the project chose to live with.

See vulnlog report impact for command usage and filters.