CISA KEV: App Packages Can Take Weeks to Ship Exploited-Flaw Fixes

Attackers have already used flaws in libraries that many apps ship, such as the image library libwebp. The fix can then take weeks to reach your app. Where a fixed Android, iOS or Flutter package did ship, it came anywhere from a day to nearly two months after the library’s own fix, and more than two weeks after it in most of those cases (26 October 2026).

Your alerts may not warn you either. CISA’s KEV list, the US government’s catalogue of flaws attackers have already used, had 10 entries in the six open-source app libraries we track on 28 October 2026. OSV.dev, a free public database of flaws, and GitHub’s Advisory Database named no Maven, Swift or pub package for any of the 10.

Those are the package types these databases cover for Android, iOS and Flutter projects. Neither covers CocoaPods. So alert tools that match these records to your packages, such as GitHub’s Dependabot, had nothing to flag (re-checked 29 October 2026).

The data: 10 exploited flaws in libraries apps bundle

How long until the fix reaches your app?

We timed 11 cases where a public Android, iOS or Flutter package already carried one of these libraries when the library shipped its fix. In 7, a fixed package release followed, anywhere from a day to nearly two months later, and more than two weeks later for over half of them. The other 4 either needed no new package release or had no fixed one by 26 October 2026.

Stacking makes it worse: in one chain of three packages, each built on the one below, the fix arrived 21, 36 and 51 days after the library’s. And those days are only the floor, because your users stay exposed until you pick up the fixed package and ship your own app update.

Source: SecureByDesignLabs analysis of public CocoaPods, Maven Central, Swift Package Manager and pub.dev release records, measured 26 October 2026 and re-checked 28 October 2026, first published here; method below.

What is the KEV list, and do you have to act on it?

CISA, the US Cybersecurity and Infrastructure Security Agency, lists a flaw only when it has a CVE ID (the public reference number a disclosed flaw gets), a clear fix, and “reliable evidence that the vulnerability has been actively exploited in the wild” (CISA’s criteria). Being merely attackable doesn’t count. The list keeps growing: 278 entries were added between 1 January and 28 October 2026.

Its deadlines bind US federal civilian agencies under directive BOD 26-04, and contractors only where their contract says so. Everyone else is “not bound by BOD 26-04”, but CISA “strongly recommends all organizations review and monitor the KEV catalog and prioritize remediation” (CISA’s KEV page).

Does a KEV listing start the EU’s 24-hour clock?

In our reading, not on its own. Since 11 September 2026, the CRA (Cyber Resilience Act), the EU’s security law for software and connected products, has required makers of products in its scope to send an early warning within 24 hours of becoming aware of “any actively exploited vulnerability contained in the product” (Article 14).

The European Commission’s guidance says a bundled component’s flaw that “cannot be exploited” or “has not been exploited” in your product “is not subject to mandatory reporting for that manufacturer” (paragraph 218). The clock starts once you’re reasonably sure your product is being exploited (paragraph 213, guidance C(2026) 5252).

So a KEV match is first something to fix, and from 11 December 2027 the CRA adds a duty to “address and remediate vulnerabilities without delay, including by providing security updates”, which is why the package wait matters. Not sure the CRA covers your app? Our CRA scope checker tells you.

For engineers

• The feed. CISA publishes the catalogue as JSON and CSV. Match library names against vendorProject, product and vulnerabilityName, because libraries are often filed under Chromium or Chrome.
• Pinned or not. A package that pins an exact library version typically brings the fix only in its own release. A Flutter plugin that lists a library’s iOS pod with no version gets it from pod update for that pod (CocoaPods guide).

Method and sources

• KEV: CISA’s JSON feed, catalogue 2026.10.28 (1,762 entries), read 29 October 2026. A search of every entry for the six library names returns these 10, the same 10 as our 25 October study (when the list held 1,756).
• Advisories: OSV.dev’s full Maven, SwiftURL and Pub exports and the GitHub Advisory Database, on 25 and 29 October 2026. A known Maven case, CVE-2021-44228, was found both times (our 25 October dataset records the first check). Commercial databases weren’t checked.
• Fix timing: public CocoaPods, Maven Central, Swift Package Manager and pub.dev release records and each library’s dated fix notice (Chrome’s release post where a library has no releases of its own), measured 26 October 2026 and re-checked 28 October 2026. The packages are a sample chosen by a fixed rule, not a census. Days run from the library’s fix to the first fixed regular (non-pre-release) package release. We don’t name packages or publish per-package results.
• Rules: CISA’s criteria page and BOD 26-04, read 28 October 2026; the CRA’s Article 14, Article 71(2) and Annex I, Part II, point 2; the Commission’s guidance of 27 July 2026. Corrections: How we measure.

Last reviewed: 29 October 2026. General information, not legal advice.