Bug 16329 - [scarthgap] migrate from unreliable NVD API to FKIE git fetch for CVE data
Summary: [scarthgap] migrate from unreliable NVD API to FKIE git fetch for CVE data
Status: NEW
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 5.0.22
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 5.0.22
Assignee: Yoann Congal
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2026-06-22 15:25 UTC by Yoann Congal
Modified: 2026-06-25 14:45 UTC (History)
5 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Yes (doc changes required)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yoann Congal 2026-06-22 15:25:56 UTC 
NVD REST API continues to be unreliable.

A migration to the FKIE git based data feed for CVE NVD data might be worth the stable exception.
Comment 1 Yoann Congal 2026-06-22 22:44:43 UTC 
A good starting point:
cve-update-db-native: add the fkie source
https://git.openembedded.org/openembedded-core/commit/?id=f6253ac8189db09fbe87141aca1733cb37a4d78f
That was later patched with: https://git.openembedded.org/openembedded-core/log/?qt=grep&q=FKIE
Comment 2 Tim Orling 2026-06-25 14:45:19 UTC 
This probably needs a proposal sent to architecture and oe-core mailing lists, since we would be looking for an exception to normal stable process.