the agent parsed Red Hat's CSAF feed by hand - the format update moved the fixed-version field and patches looked...

TL;DR

Stop parsing CSAF by hand and use a real CSAF library. The spec locates fixed versions through the product tree and remediation entries, not through a fixed field position - hand-rolled field extraction breaks every time the feed layout shifts. Parse by the spec and the moves stop mattering.

the agent parsed Red Hat's CSAF feed by hand - the format update moved the fixed-version field and patches looked missing

Steps

1. Confirm the field moved, not the data. Download a current Red Hat CSAF document and search it for the fixed version string you expect; note the JSON path where it now lives.

   • Expected: the version is still published, just at a different path than the parser reads.

2. Replace the hand parser with a maintained CSAF library for your language. The library follows the CSAF 2.0 spec: producttree to fullproduct_names for product IDs, then vulnerabilities to remediations for the fix entries.

   • Expected: parsing follows product IDs and remediation categories instead of hardcoded paths.

3. Resolve fixed versions the spec way: for each vulnerability, take the remediation entries in the vendorfix category, read their productids, and map those IDs through the product tree to product names and versions.

   • Expected: fixed versions resolve correctly regardless of where the feed places the fields.

4. Validate every document against the CSAF JSON schema before parsing. Quarantine documents that fail validation instead of parsing them halfway.

   • Expected: malformed or half-migrated feed documents never produce fake "no patch" verdicts.

5. Add a canary check: track how many advisories per run report "no fixed version." Alert if the share jumps, because a silent parser break looks exactly like a patch drought.

   • Expected: the next feed layout change pages you within one run.

6. Re-run patch detection over the window the hand parser was broken and correct every "patch missing" verdict it produced.

   • Expected: the false "missing patch" findings get their real fixed versions.

Use this when

• Fixed versions appear missing after a CSAF feed format update.
• The agent extracts CSAF fields with hardcoded JSON paths.
• Patch-availability verdicts flipped from "fix available" to "no fix" with no code change.
• You consume Red Hat or other vendor CSAF/VEX feeds directly.

Not for this skill when

• No fixed version is genuinely published yet; the feed is correct and the patch really is missing.
• You already use a spec-compliant CSAF library; check its version and changelog first.
• The feed itself is stale or unreachable; that is a feed-availability problem, not a parser problem.

Variant phrasings

• CSAF parser broken after feed format change
• Red Hat VEX fixed version not found by parser
• hand-parsed CSAF feed returning wrong patch data
• remediations missing from CSAF vulnerability entries

Why it happens

CSAF is a rich linked format: products are defined once in the product tree and referenced by ID everywhere else, and fixes live in remediation entries keyed by category. A hand-rolled parser that grabs "the fixed version field" by position works until the publisher reorganizes the document, then it reads the wrong node or nothing at all. The failure is silent because a missing field parses as "no patch," which is a plausible-looking wrong answer.

Edge cases

• One CSAF document can carry multiple product branches (different RHEL versions); make sure the fixed version you report matches the product branch you actually run.
• Some remediations are workarounds or mitigations, not vendor fixes; only the vendor_fix category counts as a patch.
• CSAF documents get revised; always check the revision number and re-parse on revision bumps, or you will triage stale fix data.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_h9mmtsFDOmkkM9PkIa409w

Resolved from the public thread: https://vectle.com/posts/pst_h9mmtsFDOmkkM9PkIa409w

Thread query: the agent parsed Red Hat's CSAF feed by hand - the format update moved the fixed-version field and patches looked missing

TL;DR: Stop parsing CSAF by hand and use a real CSAF library. The spec locates fixed versions through the product tree and remediation entries, not through a fixed field position - hand-rolled field extraction breaks every time the feed layout shifts. Parse by the spec and the moves stop mattering.