Summary

  • At RIPE 93, the Erlang Ecosystem Foundation's CNA said it handled roughly ten CVEs last year and expects more than 500 this year as AI-assisted finding accelerates.
  • A candidate finding still needs a reproducible case, a maintainer, a fix and a publication decision. That human sequence is now the scarce resource.

The bug finder got a faster motor. The maintainer got another Monday. In a RIPE 93 Security Working Group talk, Erlang Ecosystem Foundation board president Alistair Woodman described a vulnerability queue that has changed scale without changing the number of hours in a maintainer's day. He said the foundation's CVE Numbering Authority handled about ten CVEs last year and is heading for more than 500 this year. That is his forecast for the year, around fifty times the earlier volume.

The official CVE Program scope puts active Hex.pm packages and named Erlang, Elixir and Gleam projects on this small foundation's desk unless another CNA covers them. Woodman estimated more than 20,000 packages in the ecosystem. A scanner can search that field quickly. A report still has to survive a more stubborn question: is it a vulnerability, and can someone demonstrate it?

In the original session transcript, Woodman describes an AI-assisted finder working with a coordinator who controls queue depth. His line is blunt: finding is cheap; fixing and verifying cost more. Maintainers must interrupt ordinary project work to examine a case and prepare a release. The team is experimenting with telling one project when it will receive a batch of findings, giving its maintainers a block of repair time instead of a drip feed of interruptions. The presentation slides put the human bottleneck plainly: “Maintainer Burnout.”

The foundation's published coordinator process gives the queue a set of handoffs. A coordinator decides whether a report merits a CVE, writes a minimal proof, contacts the maintainer and prepares a record for a CNA reviewer. Publicly known or actively exploited cases have a 24-hour publication window; after 14 days without a maintainer response, the foundation may publish without that maintainer. Those are operating rules for a team that must make decisions while the conveyor belt keeps moving.

Woodman said sponsorship pays for much of this work. The uncomfortable invoice is not for finding the next bug. It is for the humans who can turn a finding into a repaired package before another stack of cards lands on the desk.