slimtoolkit/slim · error

invalid CVE ID: index=%d cve='%s' (%w)

Error message

invalid CVE ID: index=%d cve='%s' (%w)

What it means

IsValidCveList validates each string in a slice with IsValidCveID; on the first invalid entry it returns an error naming the slice index, the offending value, and the underlying parse error via %w. It is a pre-flight validation used by the EPSS client before making API calls.

Source

Thrown at pkg/vulnerability/epss/data.go:376

		return ErrInvalidCVEParam
	}

	sn, err := strconv.Atoi(parts[2])
	if err != nil {
		return err
	}

	if sn < 1 {
		return ErrInvalidCVEParam
	}

	return nil
}

func IsValidCveList(input []string) error {
	for idx, cve := range input {
		if err := IsValidCveID(cve); err != nil {
			return fmt.Errorf("invalid CVE ID: index=%d cve='%s' (%w)", idx, cve, err)
		}
	}

	return nil
}

var (
	_ ReplyType = (*APIResult)(nil)
	_ ReplyType = (*APIResultWithHistory)(nil)
	_ ReplyType = (*Result)(nil)
	_ ReplyType = (*ResultWithHistory)(nil)
)

View on GitHub (pinned to 81940d17fa)

Solutions

1. Normalize CVE strings to the canonical "CVE-YYYY-NNNN" form (uppercase, hyphens) before the call.
2. Pre-validate each entry with IsValidCveID and drop/skip invalid ones instead of failing the whole batch.
3. Fix the upstream parser producing the CVE list to emit canonical IDs.

Example fix

// before
ids := []string{"cve-2021-44228", "CVE-2023-0001"}
err := IsValidCveList(ids)
// after
for i := range ids { ids[i] = strings.ToUpper(ids[i]) }
ids = filterValid(ids) // drop non-canonical entries
err := IsValidCveList(ids)

var cveRe = regexp.MustCompile(`^CVE-\d{4}-\d{4,}$`)
func sanitizeCves(in []string) []string {
    var out []string
    for _, s := range in {
        s = strings.ToUpper(strings.TrimSpace(s))
        if cveRe.MatchString(s) { out = append(out, s) }
    }
    return out
}

if err := epss.IsValidCveList(ids); err != nil {
    var idx int; var cve string
    fmt.Sscanf(err.Error(), "invalid CVE ID: index=%d cve='%s'", &idx, &cve)
    log.Warnf("dropping invalid CVE at index %d: %s", idx, cve)
    ids = append(ids[:idx], ids[idx+1:]...)
}

When it happens

Trigger: Passing a []string to IsValidCveList (via the EPSS call path) containing strings that fail CVE ID format validation — e.g. missing "CVE-" prefix, non-numeric sequence, wrong year, or empty strings.

Common situations: Scanner output with malformed IDs ("cve-2021-44228", "CVE:2021-44228", trimmed IDs like "2021-44228"), or ingestion of free-text vulnerability references instead of parsed IDs.

Related errors

• podPort cannot be empty
• file path is not absolute
• file is not a binary
• bad parameter
• bad params

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/39b5acf12374a501. Report an issue: GitHub.