While qualifying my own CVSSv4 implementation, I found that 159 entries in the retained reference-scores corpus disagree with the later RedHat calculator revision.
Observed discrepancies:
- 159 affected corpus entries
- 157 unique vectors
- every score changes by exactly +0.1
- no resulting severity changes
The differences appear to follow the floating-point adjustment introduced by RedHatProductSecurity/cvss-v4-calculator@7faaaa5. I have retained an executable generator which verifies the pinned calculator and corpus by exact length and SHA-256 before reproducing the 157 corrections
Is reference-scores expected to be updated for the later rounding behaviour or is the older output intentional?
While qualifying my own CVSSv4 implementation, I found that 159 entries in the retained
reference-scorescorpus disagree with the later RedHat calculator revision.Observed discrepancies:
The differences appear to follow the floating-point adjustment introduced by
RedHatProductSecurity/cvss-v4-calculator@7faaaa5. I have retained an executable generator which verifies the pinned calculator and corpus by exact length and SHA-256 before reproducing the 157 correctionsIs reference-scores expected to be updated for the later rounding behaviour or is the older output intentional?