Hello GitHub Security Advisory team,
I am writing to ask about the review timeline for GHSA-567r-vvh5-jjr8 (CVE-2026-13006 - GHSA-567r-vvh5-jjr8), which affects ch.qos.logback:logback-core.
This is a high-severity Arbitrary Code Execution (ACE) vulnerability that has been published in the NVD for over a month, but it is currently sitting in the "Unreviewed" state in the GitHub Advisory Database.
Because it is marked as Unreviewed, standard SCA scanners that rely on GHSA (like Trivy) are completely ignoring it, leaving users unaware and exposed.
Could you provide any insight into how long it typically takes to process and update the status for critical advisories like this one, or if there is anything the community can do to help expedite the review?
Thank you!
Hello GitHub Security Advisory team,
I am writing to ask about the review timeline for GHSA-567r-vvh5-jjr8 (CVE-2026-13006 - GHSA-567r-vvh5-jjr8), which affects ch.qos.logback:logback-core.
This is a high-severity Arbitrary Code Execution (ACE) vulnerability that has been published in the NVD for over a month, but it is currently sitting in the "Unreviewed" state in the GitHub Advisory Database.
Because it is marked as Unreviewed, standard SCA scanners that rely on GHSA (like Trivy) are completely ignoring it, leaving users unaware and exposed.
Could you provide any insight into how long it typically takes to process and update the status for critical advisories like this one, or if there is anything the community can do to help expedite the review?
Thank you!