Why Cull?

Where the data comes from

No single feed has the complete picture. NVD may describe an upstream range, a Linux vendor may document a backported fix, and an exploit project may have working code. Cull currently combines 25 sources and keeps track of what each one is qualified to say.

The records are allowed to disagree. If an upstream range includes a version but Debian says its package already contains the fix, both statements remain visible. An exploit module proves that tooling exists; it does not get to decide whether a particular package is affected. Likewise, an upstream end-of-life date is never substituted for a Linux distribution's own package support policy.

Keeping the meaning of each source

Every feed uses a different schema. The importers translate those schemas into Cull's internal model while retaining the source, range boundaries and the difference between affected, fixed, not affected, withdrawn and unknown.

• 1Use a parser for each source. CPE configurations, OSV events, distro ranges, aliases and exploit references do not pass through a generic text importer.
• 2Connect aliases without erasing them. A CVE and a source-native advisory id can refer to the same issue while remaining traceable to their original records.
• 3Keep range boundaries exact. Inclusive, exclusive, exact, introduced, last-affected, fixed and open-ended ranges remain different cases.
• 4Stop a bad import. Source volume bounds, parser skip ratios, corpus shrinkage checks and identity fan-out limits block incomplete or implausible datasets.

A successful parse only means the file was readable. Cull also checks freshness, record counts and the assembled corpus. A feed that suddenly empties, a format change that skips half the records, or an identity rule that joins too many products will fail the build.

Matching different names for the same product

The same software can appear as an NVD CPE, an SBOM package URL, a distribution package or a former product name. Apache HTTP Server and Red Hat's httpd package need to meet in one search. Chrome and the Skia library it contains must remain separate even when they share CVEs.

Cull groups identifiers into a product entity while building the dataset. The links come from seven places:

• 1Separator variants. Names such as sd_675_firmware and sd675_firmware are linked. A changed letter or meaningful symbol is not ignored: 865 and 865+ can be different chips.
• 2NVD renames. Cull uses NVD's deprecatedBy field when it describes a clean one-to-one rename. A key that splits into several successors is left alone.
• 3Registry links. If a CPE points to npmjs.com/package/lodash, that is direct evidence that it names the npm package.
• 4Overlap between schemes. An opaque EUVD product key is linked to a CPE only when an exact name and shared CVEs support the match. Generic names such as “Reader” are not enough.
• 5Reviewed pairs. Roughly 179 acquisition and rebrand links cover cases rules cannot infer safely, including Sun to Oracle and Macromedia to Adobe. Each entry must include a reason.
• 6Reviewed names. This covers familiar spellings that registries do not provide, such as iOS for NVD's iphone_os.
• 7Component relations. A suite can point to one of its parts without becoming the same product. Versions cross that relation only where the comparison is safe.

A union-find pass merges the accepted links so searches do not have to walk the graph. No product may collect more than 64 identifiers. If a bad rule crosses that limit, the build fails instead of publishing an oversized product group.

Turning a query into a product

Free-text searches are ranked with BM25. Rare terms and short matching names score well; repeating the same word adds little. Exact identifiers skip that ranking step.

The query can also be an exact CPE, a package URL, a distribution package version or an advisory id such as CVE, GHSA, EUVD, DSA or USN. Bulk search accepts up to 100 targets.

Two details prevent common but convincing search errors.

Only score the name that matched

Putting every alias into one BM25 document penalizes products with many names. That once caused apache to fall out of the top results after httpd was linked to it. Cull now stores the best score for each individual name when it builds the index. Adding an alias cannot push the product down.

Suggest corrections, but do not apply them

A search for postgressql returns no findings and offers PostgreSQL as a correction. It does not silently run the corrected query. Short inputs receive no correction because one changed character can name another real product; curl and cull are a good example.

Query parsing also has to distinguish names from versions. Windows 10 1809 means Windows 10 at build 1809, not Windows at version 10. Distribution names are removed before version detection, so the final 12 in Squid 5.7-2 Debian 12 belongs to Debian.

Comparing versions

Finding the product is only the first step. Cull must then place the submitted version inside or outside every relevant advisory range. It parses the version into segments and chooses comparison rules from the package ecosystem or distribution.

1.2rc1 sorts before 1.2, while 1.2p1 sorts after it. The same string can change meaning between ecosystems: SemVer treats 1.0.0-1 as a pre-release, while Debian treats the suffix as a package revision. Maven, RubyGems, NuGet and Alpine have their own ordering rules as well.

Distribution rules are used only when the query names a distribution or contains a recognizable package version such as 7.88.1-10+deb12u5. A plain apache 2.4.49 search does not borrow Debian's backport status. If the available evidence belongs to an unspecified distribution, Cull leaves the result undecided.

Affected, ruled out or still unknown

Each relevant advisory receives a result and a reason. Unknown stays separate from ruled out so a lack of usable range data cannot look like a clean result.

• AAffected. The version is inside an affected range or an advisory names it directly.
• BRuled out. The version is outside the affected ranges, fixed, or explicitly marked not affected.
• CCould not check. The advisory is relevant, but its version or distribution scope cannot answer this query.

An unknown advisory id is reported as unchecked instead of being dropped. This matters in automation, where an empty array can otherwise look like success. A distribution may clear an upstream match only with positive evidence: fixed, not affected or out of range. An inconclusive or withdrawn record cannot clear it.

The API exposes the same distinction as AFFECTED, NOT_AFFECTED, UNKNOWN_OR_UNCHECKED and UNRESOLVED.

Exploit evidence and urgency

An affected result does not say whether exploitation is likely or whether usable tooling exists. Cull keeps exploit evidence separate from CVSS and shows where that evidence came from.

EPSS estimates likelihood. CISA KEV records observed exploitation. SSVC provides decision context. Exploit-DB, Metasploit, Nuclei and PoC-in-GitHub indicate what public tooling exists. Wordfence adds coverage for WordPress plugins that often have no CVE.

The strongest evidence determines the finding's exploit tier:

Results are ordered by this evidence before severity. Findings are ranked by whether they are known-exploited, then whether any exploit exists, then EPSS probability, and only then CVSS. A 9.8 that nobody can reach sits below a 7.5 with a maintained Metasploit module. Severity, EPSS, publication date and identifier remain available as explicit sort keys, and the tier itself is a property of the finding that does not change with the order. If Cull has a validated Nuclei template id, Metasploit module path or Exploit-DB id, it can show the corresponding command. A reference URL is never inserted into a shell command.

Working with the results

Cull's research workbench keeps the finding list next to the selected CVE. Applicability, source statements, aliases, affected ranges, fixes, exploit tooling and the event timeline stay in one place.

The query language and the controls use the same fields. openssl 1.0.1 is:kev cvss:>=9 vector:AV:N can be bookmarked and rerun. Filters are applied before totals, sorting and pagination, so the displayed count matches the filtered result.

Using the API

The HTTP API calls the same matcher as the web interface. It accepts the same targets and filters, returns the same verdict states and adds pagination and stable response schemas for integrations.

The full response includes aliases, source verdicts, affected and ruled-out evidence, unchecked records, CVSS, EPSS, KEV, SSVC, CWE, attack primitives, exploit references, commands, timelines, fixes and source disagreements. CI jobs that only need identifiers can request view=ids.

The status field removes ambiguity around empty results. AFFECTED has applicable evidence, NOT_AFFECTED resolved the target without one, UNKNOWN_OR_UNCHECKED has relevant but inconclusive evidence, and UNRESOLVED could not identify the product.

How the dataset fits in memory

Cull serves about 2,004,975 advisories from immutable in-memory structures on one machine. In the measured 2026-08-24 corpus, the SQLite database was 2.4 GB and the separate prose file 558 MB. The loaded server used about 1.6 GiB of live Go heap and 2.5 GiB steady RSS.

Structured matching data lives in the Go heap. Titles, descriptions and reference URLs live in a separate memory-mapped file because the matcher does not need them while deciding applicability. The file contains no Go pointers, so the garbage collector does not scan it. The operating system can also discard and reload those pages under memory pressure.

Repeated values are interned. In that corpus, 12.8 million range-list occurrences reduced to 311 thousand distinct values, and 3.1 million parsed-version occurrences reduced to 250 thousand. Parsed versions use one allocation each. Temporary build maps are discarded before the server reports ready.

How mistakes become tests

Most matching bugs happen at boundaries: a rename, an exclusive upper range, a package epoch, a backport, an alias collision or a disagreement between upstream and a distribution. Once one of these cases is fixed, it stays in the regression suite.