GitHub Advisory Database Overwhelmed

GitHub's security advisory system is grappling with an unprecedented surge in vulnerability reports, pushing its Advisory Database to its limits. In May 2026 alone, the platform published 1,560 reviewed advisories, a fivefold increase over its usual monthly output and an all-time high.

This isn't a fleeting spike. From March to May, GitHub processed over 6,000 advisory decisions monthly, including updates and new publications, shattering previous records. The influx spans all reporting channels: private vulnerability reports jumped from around 550 weekly to over 3,000, repository advisories surged from 650 to over 5,000 weekly, and GitHub's CVE requests neared 4,000 in May, a tenfold year-over-year increase.

A System Under Pressure

The sheer volume and complexity of incoming advisories are straining the system's throughput. While the data pipelines and publishing infrastructure remain intact and data integrity is maintained, review times have extended significantly, potentially widening the window of exposure for vulnerabilities.

The challenge lies not just in quantity, but in complexity. A growing portion of advisories require extensive curator effort to disambiguate package names across ecosystems, reconstruct inaccurate version ranges, verify multi-ecosystem impacts, and reconcile conflicting data from various sources.

This means more complex advisories, which historically were manageable, now disproportionately consume resources, creating a compounding delay. This situation reflects a broader ecosystem shift where more vulnerabilities are being reported, disclosed, and tracked than ever before.

Maintaining Quality Amidst Volume

Despite the delays, GitHub emphasizes that the quality standard for reviewed advisories has not changed. Each advisory undergoes human validation, mapping vulnerabilities to correct packages, confirming version ranges, checking upstream accuracy, and ensuring consistency.

Publishing faster by skipping verification would introduce unacceptable levels of false positives, posing a greater risk than delayed disclosures. The company is actively working to improve community contribution quality and throughput to address the backlog.