CVE id present in three repository advisories, missing from two of the global ones

Comienza con GET /advisories?cve_id=CVE-2025-9467 y compara los tres advisories del repositorio con sus registros globales promocionados, centrándote en cve_id y aliases. Rastrea el comportamiento de promoción si su punto de entrada está disponible y, a continuación, determina si los CVE compartidos deben permanecer en cada advisory global; se considera terminado cuando haya una decisión documentada y los identificadores estén corregidos o se hayan conservado intencionadamente.

Three repository advisories were published for CVE-2025-9467, one per affected repository. That split is ours, and each of the three repository advisories carries the CVE id. Two of the global advisories promoted from them do not.

All three were published on 2025-09-04 and reviewed the same day. aliases is empty on the last two, and the CVE survives only as a reference link, where no tool can use it.

The effect: GET /advisories?cve_id=CVE-2025-9467 returns one advisory, covering Vaadin 7 and 8. The Vaadin 14, 23 and 24 lines, which are the supported ones, are invisible to anyone asking by CVE. Every coordinate scanner joins on aliases, so they report those two under a GHSA id that leads back to no CVE.

Nothing disagrees on the data. The three together state exactly what the CVE record states, boundary for boundary.

The question. Is dropping the CVE on promotion intended when several advisories share one CVE? I can see the reasoning: across 5853 Maven advisories carrying a cve_id, no CVE maps to more than one, so keeping it on all three would be a first.

If it is intended, then the fix is on our side and I would rather know it: we would consolidate into a single repository advisory covering all three packages, and ask for the other two to be withdrawn as duplicates, the way GHSA-6qm2-mcq7-53qp is handled. Tell me that is the answer and I will do it.

If it is not intended, the two global records are losing an identifier their source advisories carry.

Not unique to this one: 147 Maven advisories have no cve_id, and 77 of those reference a CVE in their links.

(I opened #9515 earlier proposing to merge the ranges into one advisory and closed it myself after an automated review pointed out the siblings already carry them. They do, but where a CVE query cannot reach.)