Within Red Hat’s Coordinated Vulnerability Disclosure (CVD) framework, an embargo is a strictly-defined window of time during which a security vulnerability is known only to a small group of trusted parties before being made public, including the vulnerability reporter and the relevant upstream community and partners. Why are embargoes necessary? The primary goal of an embargo is customer protection. If a severe vulnerability is disclosed immediately upon discovery by way of "full disclosure" without an available patch, malicious actors have a window of opportunity to exploit systems while users are defenseless. An embargo provides vendors the necessary time to develop, test, and package a fix, as well as coordinate with the trusted parties mentioned above. The role of an embargo An embargo is not about secrecy for secrecy’s sake, it is a temporary, tactical head start for defenders. - Restricted access: Details are shared only with those essential to fixing the issue. - Time-boxed: Embargoes are never indefinite. Red Hat advocates for short timelines, typically under 30 days, to encourage fast remediation of issues rather than keeping them private. - External coordination: Since vulnerabilities are often reported through external channels, such as third-party security researchers, Red Hat also operates within embargo terms set by these parties. We respect the externally-defined parameters to maintain the trust required for a successful coordinated release. - Coordinated release: The embargo ends on a specific "Coordinated Release Date", where the vulnerability details and the fix are published simultaneously. Handling leaks Trust is the currency of an embargo. If information leaks to the public— such as through an upstream bug tracker or social media—prior to the agreed date, the embargo is considered broken. In these cases, Red Hat moves to immediate public disclosure so customers are aware of the risk. Getting in touch If you discover a vulnerability or suspect a leak in an existing embargo process, please contact Red Hat Product Security immediately at secalert@redhat.com. We recommend using the Red Hat Product Security GPG key for encrypted communication. Red Hat Product Security About the author More like this Red Hat to acquire Chatterbox Labs: Frequently Asked Questions Attestation vs. integrity in a zero-trust world Data Security 101 | Compiler AI Is Changing The Threat Landscape | Compiler Keep exploring - 4 ways to improve cloud securityChecklist - Security approaches for hybrid cloud environmentsWhitepaper - A layered approach to container and Kubernetes securityWhitepaper Browse by channel Automation The latest on IT automation for tech, teams, and environments Artificial intelligence Updates on the platforms that free customers to run AI workloads anywhere Open hybrid cloud Explore how we build a more flexible future with hybrid cloud Security The latest on how we reduce risks across environments and technologies Edge computing Updates on the platforms that simplify operations at the edge Infrastructure The latest on the world’s leading enterprise Linux platform Applications Inside our solutions to the toughest application challenges Virtualization The future of enterprise virtualization for your workloads on-premise or across clouds