{"record":{"id":"39b5acf12374a501","repo":"slimtoolkit/slim","slug":"invalid-cve-id-index-d-cve-s-w","errorCode":null,"errorMessage":"invalid CVE ID: index=%d cve='%s' (%w)","messagePattern":"invalid CVE ID: index=(.+?) cve='(.+?)' \\(%w\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/vulnerability/epss/data.go","lineNumber":376,"sourceCode":"\t\treturn ErrInvalidCVEParam\n\t}\n\n\tsn, err := strconv.Atoi(parts[2])\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif sn < 1 {\n\t\treturn ErrInvalidCVEParam\n\t}\n\n\treturn nil\n}\n\nfunc IsValidCveList(input []string) error {\n\tfor idx, cve := range input {\n\t\tif err := IsValidCveID(cve); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid CVE ID: index=%d cve='%s' (%w)\", idx, cve, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nvar (\n\t_ ReplyType = (*APIResult)(nil)\n\t_ ReplyType = (*APIResultWithHistory)(nil)\n\t_ ReplyType = (*Result)(nil)\n\t_ ReplyType = (*ResultWithHistory)(nil)\n)\n","sourceCodeStart":358,"sourceCodeEnd":389,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/vulnerability/epss/data.go#L358-L389","documentation":"IsValidCveList validates each string in a slice with IsValidCveID; on the first invalid entry it returns an error naming the slice index, the offending value, and the underlying parse error via %w. It is a pre-flight validation used by the EPSS client before making API calls.","triggerScenarios":"Passing a []string to IsValidCveList (via the EPSS call path) containing strings that fail CVE ID format validation — e.g. missing \"CVE-\" prefix, non-numeric sequence, wrong year, or empty strings.","commonSituations":"Scanner output with malformed IDs (\"cve-2021-44228\", \"CVE:2021-44228\", trimmed IDs like \"2021-44228\"), or ingestion of free-text vulnerability references instead of parsed IDs.","solutions":["Normalize CVE strings to the canonical \"CVE-YYYY-NNNN\" form (uppercase, hyphens) before the call.","Pre-validate each entry with IsValidCveID and drop/skip invalid ones instead of failing the whole batch.","Fix the upstream parser producing the CVE list to emit canonical IDs."],"exampleFix":"// before\nids := []string{\"cve-2021-44228\", \"CVE-2023-0001\"}\nerr := IsValidCveList(ids)\n// after\nfor i := range ids { ids[i] = strings.ToUpper(ids[i]) }\nids = filterValid(ids) // drop non-canonical entries\nerr := IsValidCveList(ids)","handlingStrategy":"validation","validationCode":"var cveRe = regexp.MustCompile(`^CVE-\\d{4}-\\d{4,}$`)\nfunc sanitizeCves(in []string) []string {\n    var out []string\n    for _, s := range in {\n        s = strings.ToUpper(strings.TrimSpace(s))\n        if cveRe.MatchString(s) { out = append(out, s) }\n    }\n    return out\n}","typeGuard":null,"tryCatchPattern":"if err := epss.IsValidCveList(ids); err != nil {\n    var idx int; var cve string\n    fmt.Sscanf(err.Error(), \"invalid CVE ID: index=%d cve='%s'\", &idx, &cve)\n    log.Warnf(\"dropping invalid CVE at index %d: %s\", idx, cve)\n    ids = append(ids[:idx], ids[idx+1:]...)\n}","preventionTips":["Canonicalize CVE strings (uppercase, hyphen separators) at ingestion time.","Validate each CVE ID individually and skip invalid entries rather than failing batches.","Fix upstream scanners/parsers to emit well-formed CVE IDs."],"tags":["validation","vulnerability","cve","input-format"],"backgroundTag":"invalid-cve-id","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}