Severity Without a Common Scale: A Cross-Ecosystem Census of Machine-Readable Severity Signals in OSV
Keywords:
OSV, CVSS, vulnerability metadata, software supply chain, package ecosystems, data qualityAbstract
Background: Package-security tools need severity metadata they can parse consistently. The Open Source Vulnerability (OSV) schema supports quantitative severity arrays at record and affected-package levels, while source databases can publish local qualitative labels. Their availability across package ecosystems has not been measured at scale.
Methods: We conducted a preregistered census of OSV ecosystem archives acquired on 1 October 2026. Of 280,270 unique records, 278,534 nonwithdrawn records formed the primary denominator. We separated quantitative items from local labels, validated declared CVSS versions, measured placement and provenance, and ran prespecified restrictions. A deterministic rerun reproduced the semantic-result hash.
Results: Only 30,577 active records (10.98%; 95% Wilson CI, 10.86%–11.09%) contained a formed schema-native quantitative severity item. Another 2,031 (0.73%) had only a local label; 245,926 (88.29%) had neither signal. Coverage ranged from 2.85% for npm to 93.50% for Maven. All 35,182 severity items were top-level CVSS vectors: 26,624 v3 and 8,558 v4. None appeared in affected-package severity arrays or populated the optional `source` field. All v3 vectors and 8,555 v4 vectors were syntactically concordant. `MAL` records accounted for 95.93% of records without standard severity. Excluding `MAL`, coverage rose to 75.20%.
Conclusions: Pooled OSV severity coverage is governed by source composition and hides ecosystem differences. Consumers should preserve missingness, version, and provenance instead of treating absent scores and local labels as equivalent. These findings measure represented metadata, not assessment correctness, exploit likelihood, or ecosystem quality.
References
1. OpenSSF Vulnerability Disclosures Working Group. Open Source Vulnerability format, schema v1.9.1. 2026. https://ossf.github.io/osv-schema/
2. Google Open Source Security Team. OSV: Open Source Vulnerabilities. https://osv.dev/
3. FIRST. Common Vulnerability Scoring System v2.0. https://www.first.org/cvss/v2/
4. FIRST. Common Vulnerability Scoring System v3.1: Specification Document. https://www.first.org/cvss/v3-1/specification-document
5. FIRST. Common Vulnerability Scoring System v4.0: Specification Document. https://www.first.org/cvss/v4-0/specification-document
6. Wunder J, Kurtz A, Eichenmüller C, Gassmann F, Benenson Z. Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities. IEEE Symposium on Security and Privacy. 2024. IEEE document 10646847; arXiv:2308.15259.
7. Croft R, Babar MA, Li L. An Investigation into Inconsistency of Software Vulnerability Severity across Data Sources. SANER. 2022. doi:10.1109/SANER53432.2022.00050.
8. Walkowski M, Nowak M, Balsam A, Nowak K, Oko J, Sujecki S. Fragmentation of CVSS scores in the NVD: A quantitative analysis of inconsistency across vulnerability scoring standards. Computers & Security. 2026;164:104978. doi:10.1016/j.cose.2026.104978.
9. Coutinho LS, Menasche D, Miranda L, Lovat E, Kumar SG, Ramchandran A, Kocheturov A, Limmer T. How Context Impacts Vulnerability Severity: An Analysis of Product-Specific CVSS Scores. Proceedings of LADC. 2024. doi:10.1145/3697090.3697109.
10. Allodi L, Massacci F. Comparing Vulnerability Severity and Exploits Using Case-Control Studies. ACM Transactions on Information and System Security. 2014;17(1). doi:10.1145/2630069.
11. Ruohonen J. A look at the time delays in CVSS vulnerability scoring. Applied Computing and Informatics. 2019;15(2):129–135. doi:10.1016/j.aci.2017.12.002.
12. Decan A, Mens T, Constantinou E. Detection, assessment and mitigation of vulnerabilities in open source dependencies. Empirical Software Engineering. 2021;26. doi:10.1007/s10664-020-09830-x.
13. National Institute of Standards and Technology. National Vulnerability Database. https://nvd.nist.gov/
14. Google Open Source Security Team. Announcing a unified vulnerability schema for open source. 24 June 2021. https://security.googleblog.com/2021/06/announcing-unified-vulnerability-schema.html
Downloads
Published
Issue
Section
License
Copyright (c) 2026 AlphaTech Systems LLC
This work is licensed under a Creative Commons Attribution 4.0 International License.
AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.
