Characterizing and Modeling the GitHub Security Advisories Review Pipeline

2026-02-05

AI Summary

This study addresses the opacity and partial official vetting of GitHub Security Advisories (GHSA), which undermines the efficiency and credibility of vulnerability disclosure. Through a large-scale empirical analysis of over 288,000 GHSA entries from 2019 to 2025, this work uncovers a previously undocumented dual-track review mechanism—comprising a “GRA fast track” and an “NVD-priority slow track”—and develops a queueing-theoretic model aligned with actual processing workflows. The research quantifies review delays, identifies key factors influencing both the likelihood of advisory review and response times, and effectively characterizes the dynamics of GHSA vetting. These findings provide a theoretical foundation and practical guidance for optimizing coordinated vulnerability disclosure mechanisms.

Technology Category

• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems
• Computer Vision: Adversarial Attacks & Robustness
• Search and Optimization: Evaluation and Analysis

Application Category

• Security and Privacy: Data transparency and provenance
• Web Mining and Content Analysis: Topic discovery and tracking
• Graph Algorithms and Modeling for the Web: Querying, indexing, and retrieval in Web-related graphs

Abstract

GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive feature of GHSA is that only a fraction of advisories are reviewed by GitHub, while the mechanisms associated with this review process remain poorly understood. In this paper, we conduct a large-scale empirical study of GHSA review processes, analyzing over 288,000 advisories spanning 2019--2025. We characterize which advisories are more likely to be reviewed, quantify review delays, and identify two distinct review-latency regimes: a fast path dominated by GitHub Repository Advisories (GRAs) and a slow path dominated by NVD-first advisories. We further develop a queueing model that accounts for this dichotomy based on the structure of the advisory processing pipeline.

Problem

• GitHub Security Advisories
• vulnerability disclosure
• review process
• advisory review
• open-source security

Innovation

• GitHub Security Advisories
• vulnerability disclosure
• review latency
• queueing model
• empirical study