Repository navigation
Conversation
The per-month cap (5000/month, i.e. 50k in October) rejects most current 2026 IDs: CVE-2026 IDs above 111k are already published. In hunt run #564, 10,711 of 13,813 RSS mentions were dropped as "implausibly high", and these are the newest IDs, the likeliest ghosts. Raise max_id_per_month to 25000 (~2x the observed 2026 pace) and the 2026 entry in max_id_by_year to 300000, which applies once 2026 is a past year. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
validate_cve_id()caps current-year IDs atcurrent_month * max_id_per_month, which is 50,000 in October. But 2026 IDs above 111,000 are already being assigned and published. In hunt run #564 (2026-10-17), 10,711 of the 13,813 RSS mentions were rejected as "implausibly high for 2026 in month 10". Those are the newest IDs, so they're also the most likely ghosts.The
2026: 30000entry inmax_id_by_yearhas the same problem one year out: it takes over once 2026 is a past year, and would then reject nearly all 2026 IDs.Change
max_id_per_month: 5000 → 25000. That's about 2x the observed 2026 pace of ~11.5k/month, so it still rejects obvious junk like 6-digit IDs in January.max_id_by_year[2026]: 30000 → 300000.The pattern checks (all zeros, same digit, embedded year, future year) are unchanged:
Heads-up: interaction with hunt run time
Most scheduled hunts since 2026-09-27 are being cancelled at the 6h job limit before
Generate Reportsruns, soghost_report.mdonly gets refreshed occasionally. The time goes toMultiSourceValidator.validate(). It calls CVE.org first for every discovery, at 30 req/min, with only an in-memory 1h cache, so already-published CVEs get re-validated over the network on every run.This PR lets about 4x more IDs through to that validator, so on its own it will likely make the timeouts worse. It should probably land together with a change that checks the local CVElist (already cached by the workflow) before CVE.org, and/or persists published CVEs so later runs skip them. I didn't include that here because it touches the pipeline more deeply. Happy to help if useful.
Minor, unrelated:
First Seenseems to be overwritten when a ghost is rediscovered. A batch of ~31 Debian tracker ghosts showed 2026-10-01, then 10-05, then 10-11 in successive reports.🤖 Generated with Claude Code