# The legacy CVE List download stops working

Calls to GET /data/downloads/* on CVE List downloads stopped working on June 30, 2024.

On June 30, 2024, support ended for legacy CVE content download formats. Requests to GET /data/downloads/* fail because the legacy formats were phased out and are no longer updated. These endpoints previously served downloads in CSV, HTML, XML, and CVRF formats.

## What to use instead

Download records in CVE JSON 5 format from the CVEProject/cvelistV5 GitHub repository using git clone or its daily release zip files, or query them from the CVE Services API at GET /api/cve/{id}. Moving requires more than updating an endpoint because the replacement provides CVE JSON 5 records rather than CSV or XML, requiring code that parses the files to be rewritten.

The replacement serves CVE JSON 5 records, not CSV or XML: the code reading the files must be rewritten for the new format.

- API: CVE List downloads (cve.mitre.org)
- Kind: Endpoint removal
- Takes effect: June 30, 2024
- Calls after that day: fail
- Calls it hits: `GET /data/downloads/*`
- Source: [Announcement](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/README.md)
- Verified: October 26, 2026, against CVE List downloads's own pages
- Page: https://www.okapi.bot/providers/cve-list-downloads/breaking-changes/the-legacy-cve-list-download-stops-working/

## CVE List downloads's words

> All support for the legacy CVE content download formats (i.e., CSV, HTML, XML, and CVRF) ended on June 30, 2024. These legacy download formats, which will no longer be updated and were phased out over the first six months of 2024, have been replaced by this repository as the only supported method for CVE Record downloads.

Okapi finds the calls this change hits in your repo and opens the pull request with the fix: https://github.com/apps/okapi-agent