Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)
• SEI Report
Publisher
Software Engineering Institute
CMU/SEI Report Number
CMU/SEI-2022-SR-012DOI (Digital Object Identifier)
10.1184/R1/19852798Topic or Tag
Abstract
The Coordinated Vulnerability Disclosure (CVD) process addresses a human coordination problem that spans individuals and organizations. In this report, we propose a formal protocol specification for Multi-Party Coordinated Vulnerability Disclosure (MPCVD) with the goal of improving the interoperability of both CVD and MPCVD processes. The Vultron protocol is composed of three interacting Deterministic Finite Automata (DFAs) for each CVD case Participant representing the Report Management (RM), Embargo Management (EM), and CVD Case State (CS) processes. Additionally, we provide guidance and commentary on the associated MPCVD Participant capabilities and behaviors necessary for this interoperability to be realized.
Cite This SEI Report
Householder, A. (2022, September 15). Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD). (SEI Report CMU/SEI-2022-SR-012). Retrieved August 18, 2026, from https://doi.org/10.1184/R1/19852798.
@techreport{householder_2022,
author={Householder, Allen},
title={Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)},
month={Sep},
year={2022},
number={{CMU/SEI-2022-SR-012},
institution={Software Engineering Institute, Carnegie Mellon University},
doi={DOI: 10.1184/R1/19852798},
url={https://doi.org/10.1184/R1/19852798},
note={Accessed: 2026-Aug-18}
}
Householder, Allen. "Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)." (CMU/SEI-2022-SR-012). Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, September 15, 2022. https://doi.org/10.1184/R1/19852798.
A. Householder, "Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, SEI Report CMU/SEI-2022-SR-012, 15-Sep-2022 [Online]. Available: https://doi.org/10.1184/R1/19852798. [Accessed: 18-Aug-2026].
Householder, Allen. "Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD)." (SEI Report CMU/SEI-2022-SR-012). Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 15 Sep. 2022. https://doi.org/10.1184/R1/19852798. Accessed 18 Aug. 2026.
Householder, Allen. Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD). CMU/SEI-2022-SR-012. Software Engineering Institute. 2022. DOI: DOI: 10.1184/R1/19852798. https://doi.org/10.1184/R1/19852798