Let's Encrypt: Failure to Document Analysis of Detected Vulnerabilities

Let's Encrypt self-reported an incident involving the failure to document and remediate critical vulnerabilities identified during weekly scans. The incident was triggered by a lack of timely documentation and remediation of vulnerabilities with CVSSv2 scores of 7.0 or higher, as required by their Network and Certificate System Security Requirements. The CA took immediate action by triaging and addressing the vulnerabilities and updated their Vulnerability Response Procedure to prevent future occurrences. The incident was resolved with a new procedure and training completed by May 14, 2025.

1. 2024-07-15 Non-compliance with vulnerability documentation begins.
2. 2025-03-21 Non-compliance identified by Let's Encrypt.
3. 2025-05-14 Training on new vulnerability response procedure completed.

1. 2025-03-21 Internet Security Research Group — Let's Encrypt identified a failure to document a compensating control for a critical vulnerability.
2. 2025-04-04 Internet Security Research Group — Full incident report submitted detailing multiple instances of non-compliance.
3. 2025-05-02 Internet Security Research Group — New vulnerability response procedure published and weekly meetings initiated.
4. 2025-05-16 Internet Security Research Group — Training on the new procedure completed, marking the remediation of the incident.