CVE id present in three repository advisories, missing from two of the global ones

Start with GET /advisories?cve_id=CVE-2025-9467 and compare the three repository advisories with their promoted global records, focusing on cve_id and aliases. Trace the promotion behavior if its entry point is available, then establish whether shared CVEs should remain on every global advisory; done means a documented decision and corrected or intentionally retained identifiers.

Three repository advisories were published for CVE-2025-9467, one per affected repository. That split is ours, and each of the three repository advisories carries the CVE id. Two of the global advisories promoted from them do not.

All three were published on 2025-09-04 and reviewed the same day. aliases is empty on the last two, and the CVE survives only as a reference link, where no tool can use it.

The effect: GET /advisories?cve_id=CVE-2025-9467 returns one advisory, covering Vaadin 7 and 8. The Vaadin 14, 23 and 24 lines, which are the supported ones, are invisible to anyone asking by CVE. Every coordinate scanner joins on aliases, so they report those two under a GHSA id that leads back to no CVE.

Nothing disagrees on the data. The three together state exactly what the CVE record states, boundary for boundary.

The question. Is dropping the CVE on promotion intended when several advisories share one CVE? I can see the reasoning: across 5853 Maven advisories carrying a cve_id, no CVE maps to more than one, so keeping it on all three would be a first.

If it is intended, then the fix is on our side and I would rather know it: we would consolidate into a single repository advisory covering all three packages, and ask for the other two to be withdrawn as duplicates, the way GHSA-6qm2-mcq7-53qp is handled. Tell me that is the answer and I will do it.

If it is not intended, the two global records are losing an identifier their source advisories carry.

Not unique to this one: 147 Maven advisories have no cve_id, and 77 of those reference a CVE in their links.

(I opened #9515 earlier proposing to merge the ranges into one advisory and closed it myself after an automated review pointed out the siblings already carry them. They do, but where a CVE query cannot reach.)