CVS is far from perfect – if you've already tried reading the manual and posting a question on the mailing list, and you still think you're looking at a bug, then you probably are.
Send as complete a description of the bug as you can to email@example.com (you can also subscribe to that list; just use firstname.lastname@example.org instead). Be sure to include the version number of CVS (both client and server versions, if applicable), and a recipe for reproducing the bug.
If you have written a patch to fix the bug, include it and mention on the subject line of your message that you have a patch. The maintainers will be very grateful.
(Further details about these procedures are outlined in the node BUGS in the Cederqvist manual and the file HACKING in the source distribution.)