Upstream Vendor Reporting

When a reported vulnerability is in a third-party component, the CRA (Article 13(6)) requires you to report it to the person or entity that maintains the component. CVD Portal can send this report for you.

Send an upstream report

1. Open the report in Submissions.
2. In the Upstream Coordination (CRA Art. 13(6)) panel, enter:
   • Component name
   • Maintainer email
   • Security fix or patch URL (optional, HTTPS only)
   • Message or integration notes (optional)
3. Click Share Securely Upstream.

CVD Portal sends an email to the maintainer. The reply-to address is your email address, so the maintainer replies to you directly. CVD Portal records the upstream report and writes an audit log entry.

Limits

• You can send one upstream report for each vulnerability report.
• CVD Portal does not track the maintainer acknowledgment, the maintainer fix timeline or the integration of the fix into your product.