Reconcile a severity label with its CVSS vector

What the check reads

The verify-stage warning applies to active KnownIssues with a parsable CVSS vector that yields a qualitative band. It compares that band with severity and flags a strictly lower recognized label. A severity_bound with both reviewer and rationale records an exception. The check does not depend on severity_basis or cve_surface. Missing, invalid or unscored vectors are outside this comparison.

proof audit --check cvss_severity_consistent

An illustrative case

Illustrative case: an issue is labeled low after a reproducer shows restricted reachability, but its unchanged vector still describes much broader impact. Merely setting severity_basis to reproducer leaves contradictory claims. Review whether the vector should change, the label should rise, or a severity_bound should explain the legitimate difference.

Resolve the finding

1. Read the reproducer, exposure assumptions and vector metrics together.
2. Correct the vector or categorical label if either misstates the finding.
3. If both express different justified scopes, record the reviewer and rationale in severity_bound, then rerun the check.

What a clear result means

This check detects under-labeling relative to a recorded vector. It does not validate each metric against reality, calculate business risk or resolve over-rating; severity inflation is a separate check. A stamped explanation is an accountable decision, not proof of the vulnerability or its consequences.

Continue with one real issue

Severity inflation · High severity reproducer grade

Bring one finding, its requirement and the current evidence to scope a walkthrough of what your reviewer can establish and what still needs work.