Problem
OSS-Fuzz marks bugs as "fix verified" but the corresponding YAML files in this repo never gain a fixed event. The pipeline continues adding new release tags to affected.versions without closing the range, producing false-positive alerts downstream.
Example: jq (OSV-2024-396, OSV-2024-440)
OSS-Fuzz: Fix verified
This repo: No fixed event
jq-1.8.2 (released 2026-06-20) is listed as affected. The crashed function (jvp_object_free) no longer exists in the binary, confirmed via nm and by the jq maintainer: jqlang/jq#3575
The YAML was updated on 2026-06-20 to add jq-1.8.2 to affected versions, but no fixed event was added.
Questions
- Is the "fix verified" to
fixed event step automated or manual?
- What caused it to miss these entries?
- How many other YAML files have the same disconnect?
Downstream impact
osv-scanner, grype, Deps.dev, and GitHub Advisory Database all consume OSV. Projects using jq >= 1.8.0 are flagged as vulnerable despite the fix being present.
Problem
OSS-Fuzz marks bugs as "fix verified" but the corresponding YAML files in this repo never gain a
fixedevent. The pipeline continues adding new release tags toaffected.versionswithout closing the range, producing false-positive alerts downstream.Example: jq (OSV-2024-396, OSV-2024-440)
OSS-Fuzz: Fix verified
This repo: No
fixedeventvulns/jq/OSV-2024-396.yamlvulns/jq/OSV-2024-440.yamljq-1.8.2(released 2026-06-20) is listed as affected. The crashed function (jvp_object_free) no longer exists in the binary, confirmed vianmand by the jq maintainer: jqlang/jq#3575The YAML was updated on 2026-06-20 to add
jq-1.8.2to affected versions, but nofixedevent was added.Questions
fixedevent step automated or manual?Downstream impact
osv-scanner,grype, Deps.dev, and GitHub Advisory Database all consume OSV. Projects usingjq >= 1.8.0are flagged as vulnerable despite the fix being present.