Coordinated Disclosure

Coordinated disclosure is the practice of agreeing, between the people who find a security vulnerability and the people who have to fix it, on when the vulnerability and its fix become public. The researcher reports the flaw privately, the maintainer develops a fix, downstream distributors prepare their own builds, and everyone publishes together on an agreed date. The goal is that users can install a fix on the day they learn the flaw exists, rather than learning about it from an attacker.

What is coordinated disclosure?

Three groups take part.

Researchers find the vulnerability and report it privately to the project.

Maintainers of the affected software confirm the bug, write and test a fix, and request a CVE identifier.

Distributors, such as Linux distributions and vendors who bundle the software, receive the fix in advance under a security embargo so they can build, test, and stage patched packages for the versions they ship.

On the disclosure date the advisory, the upstream fix, and the distribution packages go public at once. Users see a CVE with a patch already waiting in their update channel. That simultaneity is the whole value: the moment a fix is public, anyone can read the change and work backwards to an exploit, so a fix without packages is a head start for attackers.

The alternatives define the practice by contrast. Full disclosure publishes the vulnerability immediately, with or without a fix, on the argument that users deserve to know what they are exposed to. Non-disclosure keeps it private indefinitely. Coordinated disclosure sits between them: a bounded period of privacy in exchange for a fix being ready. Projects and distributor lists publish disclosure policies with a maximum embargo, so that a fix can't be held back indefinitely. The Linux kernel security team allows up to 7 calendar days, extended to 14 only for critical bugs, and the linux-distros list accepts no more than 14 days.

Why coordinated disclosure matters

For an organization running the software, coordinated disclosure decides what the first day of a vulnerability looks like. A well coordinated disclosure means the advisory and the package arrive together, and the work is an inventory check and a rollout. A broken one means a public exploit path with no fix, and the work is emergency mitigation.

For a distributor, it decides whether the fix for an older version exists on day one. Upstream projects fix their current branches. A distribution that ships an older version, which is normal in Enterprise Linux, where a release pins a version for years, has to backport the fix during the embargo so that it ships at the same time. That work is invisible when it goes well and very visible when it does not.

The stages of a coordinated disclosure

Stage	Who	What happens
Report	Researcher to maintainer	Private report with enough detail to reproduce, through a security contact or a platform such as GitHub security advisories
Triage	Maintainer	Confirm the bug, assess severity, request a CVE, set a target date
Fix	Maintainer	Develop and test the fix on supported branches
Pre-notification	Maintainer to distributors	Share the fix under embargo, for example through the linux-distros list, so distributors can build packages for their versions
Disclosure	Everyone	Advisory, upstream release, and distribution packages published together
Follow up	Distributors and users	Backports for versions not covered upstream, knowledge base articles, patch status updates

The timing is a judgment call at every stage. Too short an embargo and distributors cannot finish their builds. Too long and the chance of a leak grows, because every additional person who knows is a possible source.

When coordinated disclosure breaks

Embargoes break. Someone posts details to a forum, a researcher publishes a demonstration early, a patched build or public commit appears before the date and the diff gives the bug away, or someone else finds the same flaw independently.

When an embargo breaks, the plan collapses into the alternative it was designed to avoid: everyone has the vulnerability and only some people have the fix. The outcome then depends on how quickly each distributor finishes builds for the versions it ships.

AI-assisted vulnerability research is making coordination harder. The Linux kernel security team now asks reporters to treat any bug found with AI assistance as public, because such bugs surface across several researchers at once. Nathan Blackham describes what that pace meant for PHP2Shell in Patch PHP2Shell now and prepare for the next AI-found CVE, and our guide on staying secure when AI finds vulnerabilities faster covers what it means for a Linux security program.

Coordinated disclosure at CIQ

CIQ takes part in coordinated disclosure as the distributor of Rocky Linux from CIQ Pro (RLC Pro). When CIQ receives a fix under embargo, its engineers backport it to the RLC Pro and RLC Pro LTS versions customers run and prepare packages for the disclosure date. Security issues in CIQ products can be reported through the security page, which describes how CIQ handles a report, how it treats issues under embargo, and what it publishes after an embargo lifts.