{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/carnegie-mellon-university/main/json-schema/carnegie-mellon-university-cert-vulnerability-note.json",
  "title": "CERT/CC Vulnerability Note",
  "description": "A published Vulnerability Note (VU#nnnnnn) from the CERT Coordination Center, CMU Software Engineering Institute. Field names are the API's own, verbatim — including the misspelled `cvss_exploitablity`.",
  "x-provenance": {
    "generated": "2026-08-19",
    "method": "derived",
    "source": "Live probe of https://kb.cert.org/vuls/api/421644/ on 2026-08-19 (55-field payload), cross-checked against VU#257161 and VU#730793",
    "x-operator": "institution",
    "authorship": "Written by API Evangelist. CMU SEI publishes no JSON Schema for this API."
  },
  "type": "object",
  "required": ["vuid", "idnumber", "name"],
  "properties": {
    "vuid": { "type": "string", "pattern": "^VU#[0-9]{6}$" },
    "idnumber": { "type": "string", "pattern": "^[0-9]{6}$" },
    "name": { "type": "string" },
    "keywords": { "type": ["string", "null"] },
    "overview": { "type": ["string", "null"], "description": "Markdown." },
    "clean_desc": { "type": ["string", "null"] },
    "impact": { "type": ["string", "null"] },
    "resolution": { "type": ["string", "null"] },
    "workarounds": { "type": ["string", "null"] },
    "sysaffected": { "type": ["string", "null"] },
    "thanks": { "type": ["string", "null"] },
    "author": { "type": ["string", "null"] },
    "public": { "type": ["array", "null"], "items": { "type": "string" } },
    "cveids": { "type": ["array", "null"], "items": { "type": "string" } },
    "certadvisory": { "type": ["string", "null"] },
    "uscerttechnicalalert": { "type": ["string", "null"] },
    "datecreated": { "type": ["string", "null"], "format": "date-time" },
    "publicdate": { "type": ["string", "null"], "format": "date-time" },
    "datefirstpublished": { "type": ["string", "null"], "format": "date-time" },
    "dateupdated": { "type": ["string", "null"], "format": "date-time" },
    "revision": { "type": ["integer", "null"] },
    "ipprotocol": { "type": ["string", "null"] },
    "metric": { "type": ["number", "null"] },
    "vulnote": { "type": ["string", "null"] },
    "cvss_basescore": { "type": ["number", "null"] },
    "cvss_basevector": { "type": ["string", "null"] },
    "cvss_temporalscore": { "type": ["number", "null"] },
    "cvss_environmentalscore": { "type": ["number", "null"] },
    "cvss_environmentalvector": { "type": ["string", "null"] },
    "cvss_exploitablity": { "type": ["string", "null"], "description": "Misspelled in the API; preserved verbatim." }
  },
  "$defs": {
    "VendorStatement": {
      "type": "object",
      "description": "One vendor's coordination record for a Vulnerability Note.",
      "required": ["note", "vendor"],
      "properties": {
        "note": { "type": "string" },
        "vendor": { "type": "string" },
        "contact_date": { "type": ["string", "null"], "format": "date-time" },
        "references": { "type": ["string", "null"] },
        "statement": { "type": ["string", "null"] },
        "statement_date": { "type": ["string", "null"], "format": "date-time" },
        "addendum": { "type": ["string", "null"] },
        "dateupdated": { "type": ["string", "null"], "format": "date-time" }
      }
    },
    "NoteVulnerability": {
      "type": "object",
      "description": "One CVE rolled into a Vulnerability Note.",
      "required": ["note", "cve"],
      "properties": {
        "note": { "type": "string" },
        "cve": { "type": "string", "description": "CVE identifier WITHOUT the 'CVE-' prefix, e.g. 2024-27268." },
        "description": { "type": ["string", "null"] },
        "uid": { "type": ["string", "null"] },
        "case_increment": { "type": ["integer", "null"] },
        "date_added": { "type": ["string", "null"], "format": "date-time" },
        "dateupdated": { "type": ["string", "null"], "format": "date-time" }
      }
    }
  }
}