CVE id present in three repository advisories, missing from two of the global ones

GET /advisories?cve_id=CVE-2025-9467 から始め、3 つの repository advisories と、それらに対応する昇格済みの global records を比較します。cve_id と aliases に重点を置きます。エントリーポイントが利用可能な場合は promotion の挙動を追跡し、その後、共有されている CVE をすべての global advisory に残すべきかを判断します。完了とは、判断を文書化し、識別子を修正するか、意図的に維持することです。

Three repository advisories were published for CVE-2025-9467, one per affected repository. That split is ours, and each of the three repository advisories carries the CVE id. Two of the global advisories promoted from them do not.

All three were published on 2025-09-04 and reviewed the same day. aliases is empty on the last two, and the CVE survives only as a reference link, where no tool can use it.

The effect: GET /advisories?cve_id=CVE-2025-9467 returns one advisory, covering Vaadin 7 and 8. The Vaadin 14, 23 and 24 lines, which are the supported ones, are invisible to anyone asking by CVE. Every coordinate scanner joins on aliases, so they report those two under a GHSA id that leads back to no CVE.

Nothing disagrees on the data. The three together state exactly what the CVE record states, boundary for boundary.

The question. Is dropping the CVE on promotion intended when several advisories share one CVE? I can see the reasoning: across 5853 Maven advisories carrying a cve_id, no CVE maps to more than one, so keeping it on all three would be a first.

If it is intended, then the fix is on our side and I would rather know it: we would consolidate into a single repository advisory covering all three packages, and ask for the other two to be withdrawn as duplicates, the way GHSA-6qm2-mcq7-53qp is handled. Tell me that is the answer and I will do it.

If it is not intended, the two global records are losing an identifier their source advisories carry.

Not unique to this one: 147 Maven advisories have no cve_id, and 77 of those reference a CVE in their links.

(I opened #9515 earlier proposing to merge the ranges into one advisory and closed it myself after an automated review pointed out the siblings already carry them. They do, but where a CVE query cannot reach.)