...

Once the fixes are released and you're happy with the advisory, you can send the notification emails with the 'Send these Emails' button on the 'OSS/ASF Emails' page.

After this, the Security Team will make sure the advisory is uploaded to the global CVE database in the JSON format described at https://github.com/CVEProject/cve-schema/

Publishing as OSV

A more modern file format to publish advisories is OSV. While it'd be great to be able to publish machine-readable advisories on our own infrastructure (as well as through CVE), this ecosystem is still in its early days. If you want to experiment, feel free to email security@apache.org for assistance or discuss your plans on the public security-discuss list.

...