---
id: "osv_id"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software"]
langs: ["common"]
quality: 75
url: "http://registry.apicrafter.io/datatype/osv_id"
---
# OSV vulnerability ID (`osv_id`)
> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.
Identifier of an entry in the Open Source Vulnerability (OSV) format that OSV.dev aggregates: the prefix of the entry's home database, a hyphen and an id in that database's own format, for example PYSEC-2021-63, RUSTSEC-2021-0003, GO-2022-0969 or GHSA-... Local databases that OSV.dev does not aggregate use the prefix x_. Ids contain only ASCII letters, digits and the characters : _ . -. The regexp lists the database prefixes that the OSV JSON schema defined in November 2026; new databases are added over time. CVE and GHSA identifiers are also OSV ids.
- Personal data (PII): no
- Categories: Software development (software)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier
## Detection
Regular expression (Python `re`):
```
^(?:x_|(?:ASB-A|PUB-A|ALPINE|ALSA|ALBA|ALEA|AZL|BELL|BIT|BREW|CGA|CLEANSTART|CLSA|CURL|CVE|DEBIAN|DHI|DRUPAL|DSA|DLA|ELA|DTSA|ECHO|EEF|FreeBSD|GHSA|GO|GSD|HSEC|JLSEC|KUBE|LBSEC|LSN|MAL|MINI|MGASA|OESA|OSEC|OSV|openSUSE-SU|PHSA|PSF|PYSEC|RHBA|RHEA|RHLW|RHSA|RLSA|RXSA|RPI|RSEC|ROOT|RUSTSEC|SUSE-[SRFO]U|UBUNTU|USN|V8|VCPKG)-)[A-Za-z0-9:_.-]+$
```
## Examples
- `OSV-2020-111` — Example in the OSV schema documentation
- `PYSEC-2021-63` — Entry for the cryptography package on PyPI
- `RUSTSEC-2021-0003` — RustSec entry for smallvec
- `GO-2022-0969` — Go vulnerability database entry for net/http
- `x_CUSTOM-0001` — Local database, example in the OSV schema documentation
- `FOO-2021-0001` (invalid example) — FOO is not a defined database prefix
## Sources
- doc:
- other:
## Quality
Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.
JSON: · Edit: