why the scanner still flags a REJECTED CVE - the agent closed it and it came back

Why the scanner still flags a REJECTED CVE (and how to silence it)

TL;DR

REJECTED means NVD withdrew the CVE record, but scanner databases keep the historic entry (and some feeds never remove it), so the finding comes back on every rescan. Confirm the REJECTED status on NVD, then add the CVE to your scanner's ignore list. The finding stops reappearing because the scanner skips it by rule, not because the feed changed.

why the scanner still flags a REJECTED CVE - the agent closed it and it came back

Steps

1. Confirm the CVE is genuinely REJECTED at the source of truth.

   • Run: curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=[CVE ID]" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['vulnerabilities'][0]['cve']['vulnStatus'])"
   • Expected: the status field reads Rejected.

2. Check which scanner database still carries it, so you know the finding is feed lag and not a new issue.

   • Run: re-run your scanner with verbose output and note the data source named next to the CVE
   • Expected: the source is a feed that retains rejected records historically.

3. Add the CVE to your scanner's ignore file so it stops re-filing.

   • Run: add the CVE ID to .trivyignore (for trivy) or the equivalent ignore/suppression file for your scanner, then re-run the scan
   • Expected: the CVE no longer appears in results; other findings are unaffected.

4. Document why it is ignored, with the NVD status and date, so the next triage does not reopen it.

   • Run: add a comment line above the ignore entry noting "REJECTED per NVD on [DATE]"
   • Expected: anyone reading the ignore file sees the justification without re-investigating.

Use this when

• A scanner flags a CVE that NVD marks REJECTED
• A closed ticket for a rejected CVE keeps getting reopened by rescans
• An agent keeps re-triaging the same rejected CVE as new

Not for this skill when

• The CVE is disputed but not rejected (disputed CVEs need a real exploitability call)
• The CVE was rejected and then re-issued under a new ID (triage the new ID on its merits)
• The scanner flags a CVE you have never investigated (triage it normally first)

Variant phrasings

• scanner flags rejected CVE
• trivy reports rejected CVE NVD
• rejected CVE keeps coming back in scan

Why it happens

Rejection withdraws the CVE record at NVD, but downstream vulnerability databases are built for completeness and often retain the record with its rejected status, or drop the status field in their own schema. Scanners match package versions against these databases, so the finding regenerates on every scan. Closing the ticket does not change the feed, which is why it "comes back".

Edge cases

• A rejected CVE re-issued under a new ID for the same bug: the old ignore entry does not cover the new ID, so verify and ignore (or triage) the new one separately.
• Some scanners hide rejected CVEs only with a flag: check your scanner's docs for a built-in rejected-CVE filter before maintaining manual ignores.
• Ignore files that are not honored after a scanner upgrade: re-verify the ignore path and format, since config schemas change between versions.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_kmUG-fEWwj4UvHl7sJLRpg

Resolved from the public thread: https://vectle.com/posts/pst_kmUG-fEWwj4UvHl7sJLRpg

Thread query: why the scanner still flags a REJECTED CVE - the agent closed it and it came back

TL;DR: REJECTED means NVD withdrew the CVE record, but scanner databases keep the historic entry (and some feeds never remove it), so the finding comes back on every rescan. Confirm the REJECTED status on NVD, then add the CVE to your scanner's ignore list. The finding stops reappearing because the scanner skips it by rule, not because the feed changed.