Cyber ·
Three X.Org CVEs still show as reserved at MITRE with no published details
An oss-sec thread dated October 27, 2026 asks why three vulnerability identifiers for X.Org client libraries still appear as reserved, with no published details, in the MITRE record.
This item is a reply on the oss-sec mailing list, posted on October 27, 2026, to an X.Org security advisory about multiple problems in the project's client libraries. The text states that it was provided through machine translation of the list feed.
A participant asks why three CVEs linked to the advisory, identified as CVE-2026-109088, CVE-2026-109089 and CVE-2026-109090, still appear as RESERVED at MITRE with no information published. The author cites one identifier on the cve.org portal as an example. The available text does not include a reply explaining the delay.
For your team, the relevant point is that a reserved identifier alone does not confirm severity, the affected component or a fixed version. Before acting, check the original advisory on the list, the projects' release notes and the updated official records, and confirm whether the X.Org libraries are present in your systems.