What Does "N/A" Mean in Linux OS Vulnerability Ranges, and When Is It Replaced?

The Analog package includes vuln_system_associations.json, which maps CVEs to operating systems and their packages. For Linux, each association carries a version range for the affected package on a specific distribution release. When the distribution has confirmed that a package is affected but has not yet released a fixed version, the upper bound of that range is shown as "N/A".

This article explains what "N/A" means, which distributions can report it, how and when it is replaced with a fixed version, and why it can remain in place permanently for some releases.

What "N/A" means

For Linux associations, the upper bound of the affected range holds the version in which the distribution fixed the vulnerability. When no fixed version exists yet, the upper bound reads:

"limit_except": "N/A"

For Debian, the same condition appears in the limit field:

"limit": "N/A"

In both cases the meaning is the same: the distribution lists the package as affected on that release and has not published a fixed version. This does not always mean a fix is on the way. For Red Hat Enterprise Linux and SUSE Linux Enterprise, "N/A" covers every unfixed status the vendor reports: a fix that is still pending, but also Will not fix, Fix deferred and Out of support scope. To see which status applies to a specific CVE, check the vendor’s own CVE page.

"N/A" is not a missing value or a data error. No installed version of the package on that release can be treated as remediated for that CVE until a fixed version is published.

Which distributions can report "N/A"

Whether "N/A" can appear depends on the kind of security data each distribution publishes.

Distribution	Can report "N/A"?	Source of the vulnerability data
Ubuntu	Yes	Ubuntu CVE Tracker
Debian	Yes (in `limit`)	Debian Security Tracker
Red Hat Enterprise Linux	Yes	Red Hat security data (VEX)
SUSE Linux Enterprise	Yes	SUSE security data (CSAF VEX)
Linux Mint	Yes	Derived from Ubuntu's data and updated together with it
Oracle Linux, Amazon Linux, AlmaLinux, Rocky Linux, Fedora	No	Published security advisories and errata

The first group publishes the status of unfixed vulnerabilities, so OESIS can report a package as affected before a fix exists. The second group publishes advisories only once a fix is released, so a CVE appears for these distributions only after a fixed version exists, and its range always carries that version.

How "N/A" is replaced

The Linux vulnerability data is refreshed on a regular cycle. On each cycle, OESIS asks each distribution's security data which CVEs have changed since the previous cycle. Every changed CVE is re-processed, including CVEs that are already in the data. Its existing ranges are discarded and rebuilt from the distribution's current information.

When a distribution marks a package as fixed, it updates that CVE in its security data. The next cycle picks up the change and replaces "N/A" with the fixed version the distribution published. No manual step is involved.

CVEs that a distribution has not changed are not re-processed, because there is no new information to apply.

How long the update takes

Three separate delays add up between a distribution announcing a fix and the fixed version appearing in your system.

Stage	Typical delay	Who controls it
The distribution adds the fix to its machine-readable security data	Varies; this can lag behind the distribution's public announcement	The distribution
OESIS processes the change and publishes it in the Analog package	Usually 1 to 5 hours after the fix appears in the distribution's security data; occasionally up to about 9 hours	OPSWAT
Your integration downloads the updated Analog package	Depends on your download schedule	You

For the Analog publication cadence, see How often is the Analog.zip updated?

When "N/A" remains in place

"N/A" is replaced only when the distribution publishes a fix. If it never does, the range correctly stays "N/A". This is most common on releases that have reached end of life, where the distribution no longer ships fixes.

Aspect	Detail
Distribution and release	SUSE Linux Enterprise Server 15 SP1
Package	`boost`
Status in SUSE's security data	Affected
OESIS range	Upper bound `"N/A"`

If SUSE marks boost on SLES 15 SP1 as fixed, the next update cycle replaces "N/A" with SUSE's fixed version automatically. However, SLES 15 SP1 has reached end of life, so SUSE may never ship a fix for it. In that case the range remains "N/A", which accurately reflects that the vendor has not fixed the vulnerability on that release.

Recommendations for your integration

Treat "N/A" as affected, no fix available, and present it to your users that way rather than as unknown or missing data.
Re-evaluate Linux CVE results each time you load a new Analog package, rather than caching the range from an earlier package. A range that read "N/A" yesterday may carry a fixed version today.
If a distribution's security data has shown a fixed version for longer than the delays described above, and the range in your current Analog package still reads "N/A", open a support case with the CVE ID, the distribution and release, the package name, and the date of your Analog package.

Support

If Further Assistance is required, please proceed to log a support case or chat with one of our support engineers.

Last updated on

Was this page helpful?