OneTaskBy Tim King · Updated
CVE ID Validator
Check Your CVE Number Format, Spot Typos and Duplicates in a List
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the CVE ID Validator works
This CVE ID validator checks a pasted list of vulnerability identifiers and flags any that are not in the official CVE-YYYY-NNNN format. Paste IDs from a scanner report, spreadsheet or ticket, separated by spaces, commas or new lines, and each one gets a result and a link to its record.
What the CVE ID validator checks
A CVE ID has three parts: the prefix CVE, the year the ID was reserved or published, and a sequence number of at least four digits. Since 2014 the sequence can be longer than four digits, so CVE-2024-12345 is valid, but a longer number must not start with a zero, and CVE-2024-0000 is never issued.
The validator checks each part. It flags years before 1999, when the list began, or later than next year, sequences that are too short or padded with zeros, and missing or extra dashes. Lower-case IDs are valid but marked, as many tools only match upper case. GitHub advisory IDs such as GHSA-xxxx and OSV IDs are recognised and labelled as a different system rather than rejected as typos.
Repeated IDs are reported once as valid and then as duplicates, which helps when merging reports from several scanners. A valid format does not prove the ID exists, so follow the cve.org link to confirm it.
FAQ
Why is CVE-2024-1234567 accepted?
The sequence number has no fixed upper length. Numbering authorities are given blocks of numbers and some use long ones, so any length of four digits or more is valid as long as it does not start with zero.
Does a valid format mean the CVE is real?
No. The check is only on the shape of the ID, since this page makes no network requests. Open the cve.org link to see whether it was published, is still reserved, or was rejected as a duplicate.
What is the difference between a CVE and a GHSA ID?
CVE is the shared public list run by MITRE for the CVE Program. GHSA IDs are GitHub's own advisory identifiers. Many GHSA advisories also have a CVE ID, which you can find on the advisory page.
Why is the year sometimes earlier than the disclosure?
The year is when the ID was reserved, not when the flaw was announced. A number reserved in December and disclosed in February keeps the earlier year, so the year is not a reliable disclosure date.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
CVSS Calculator
Score a vulnerability with CVSS 3.1 from metrics or a vector.
OWASP Top 10 Reference
The OWASP Top 10 web risks with plain explanations and fixes.
Secret Scanner
Find leaked API keys, tokens and passwords in pasted code.
URL Validator
Check a list of URLs for syntax errors, one per line.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.