Skip to content

Limit 2000 on CVE vs limit 10000 on CPE #69

@vladovarga

Description

@vladovarga

I noticed in the code that there is a constant of 2000 that is used as limit in calls.

For example here
https://github.com/vehemont/nvdlib/blob/main/nvdlib/cpe.py#L217
or here
https://github.com/vehemont/nvdlib/blob/main/nvdlib/get.py#L54

Firstly, would be nice to have this constant actually as a constant in the code. (not as a local variable)

I believe this value of 2000 is there because of the CVE endpoint says so in the docs https://nvd.nist.gov/developers/vulnerabilities
This value has been optimized to allow the greatest number of results over the fewest number of requests.

But according to the CPE endpoint https://nvd.nist.gov/developers/products:
For network considerations, the default value and maximum allowable limit is 10,000.

There is a difference between the CPE and CVE limit. I am currently working with CPEs and this limit is bit restraining. I would like to not use any limits as 10K is sufficient for my use-case.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions