Javel Rowe

Can one CVE ID point to two vulnerabilities?

· 4 min read · tips, cve, trivy

TLDR:

How does a vulnerability get a CVE ID?

Someone finds a vulnerability and reports it to a CVE Numbering Authority (CNA). The CNA requests and reserves an ID, fills in the details, then publishes the record so anyone can see it.

Can it go to any CNA?

Each CNA has a scope that states what it's allowed to assign IDs for.

  • Vendor and project CNAs cover their own products, so for webpack, the OpenJS Foundation would have appropriate scope since they manage the package.
  • Research CNAs cover vulnerabilities they find or get told about, unless a CNA with a more specific scope covers that product.
  • The rules say the CNA with the most appropriate scope should be contacted first and given the first chance to assign. (CNA Operational Rules, 4.2.1.1)

CNAs also sit in a hierarchy:

  • Each CNA reports to a Root. For example, OpenJS reports to Red Hat.
  • Roots report to the Top-Level Root, which is MITRE.

What happens if a vulnerability doesn't fit a scope, or fits more than one?

The CNA with the most specific scope takes jurisdiction. A project's own CNA beats a general research CNA. If no scope fits, it falls to research CNAs, or to the CNA of Last Resort (MITRE).

What happens after a CVE is published?

The published records are available in the CVE List. Its history is public in the cvelistV5 repo on GitHub, so you can see each version of a record.

Here’s how the data flows from the CVE list to a security scanner (in this case, Trivy):

  • Feeds pick it up from there: NVD, Red Hat, Amazon Linux (ALAS), the GitHub Advisory Database (GHSA), the Debian security tracker and others.
  • Each feed pulls on its own schedule and has its own processes:
    • NVD adds its own analysis on top, like CVSS scores and a CWE.
    • Distros like Debian and Red Hat map the CVE to their own package versions and fixes.
    • GHSA advisories get reviewed and are often written with the project's maintainers.
  • Some of this is automated with a review step and some sources also combine data from several other sources.
  • Trivy then pulls from the various feeds to populate its database of vulnerabilities.

Here's what the situation looked like in Trivy, in a lab image that has both packages (perplexedyawdie/cve-2026-76844-lab):

  • It matched both packages correctly using data from the Debian tracker for zlib1g, and GHSA for the npm package.
  • The details show the mismatch. Trivy keeps one detail record per CVE ID and attaches it to both findings. The title came from Red Hat (webpack), and the description and CWE came from NVD (zlib).
  • Ignoring the CVE in .trivyignore hides both findings.
$ cat results/matches.txtTYPE      PACKAGE                 INSTALLED                    FIXED                             DATA SOURCEdebian    zlib1g                  1:1.3.dfsg+really1.3.1-1+b1  1:1.3.dfsg+really1.3.1-1+deb13u1  debiannode-pkg  webpack-dev-middleware  8.1.1                        8.3.0, 7.4.6                      ghsa

$ cat results/details.json[  {    "PkgName": "zlib1g",    "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal",    "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_wri...",    "CweIDs": [      "CWE-787"    ],    "References": {      "webpack": 9,      "zlib": 4    }  },  {    "PkgName": "webpack-dev-middleware",    "Title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal",    "Description": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_wri...",    "CweIDs": [      "CWE-787"    ],    "References": {      "webpack": 9,      "zlib": 4    }  }]

$ cat results/provenance.txtTrivy Title:          webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path TraversalRed Hat bugzilla:     webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal  match: yes​Trivy Description:    zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_wri...NVD description:      zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_wri...  match: yes

$ cat results/trivyignore.txtCVE-2026-76844 findings without .trivyignore: 2CVE-2026-76844 findings with .trivyignore:    0

What does this say about the tools we rely on?

  • Trust, but verify. A scanner can only be as consistent as the sources behind it.
  • Knowing which data sources feed your tool can help with handling discrepancies. For Trivy that's distro trackers, GHSA, NVD and others, and different fields can come from different places.
  • Take it a step further and understand how those sources get their data and what checks happen along the way.
  • When something looks off, check the package's own feed directly.

When did each change happen?

All times UTC (2026).

When Event Source
Aug 19 CVE-2026-76844 reserved CVE Services API
Aug 24 13:12 Record published describing a path traversal in webpack-dev-middleware cvelistV5 211711e
Aug 24 13:25 Red Hat Bugzilla entry created for webpack-dev-middleware Bugzilla 2521896
Aug 24 14:17 Record appears in NVD NVD change history
Aug 26 Record references updated cvelistV5 f59bcd3
Aug 28 ALAS page last modified, describing webpack-dev-middleware ALAS
Sep 3 GitHub advisory for webpack-dev-middleware published, listing CVE-2026-76844 GHSA-g84c-rxfj-3j2c
Sep 21 Red Hat erratum for webpack-dev-middleware released RHSA-2026:69296
Sep 29 Duplicate GitHub advisory withdrawn GHSA-p3f5-w63m-mxph
Oct 1 10:46 Record adds fixed versions 7.4.6 and 8.3.0 for webpack-dev-middleware cvelistV5 8681b2f
Oct 1 11:03 Record changes to describe a heap buffer overflow in zlib 1.2.11 through 1.3.2 cvelistV5 c1fa2f3
Oct 1 11:17, 12:17 NVD record updated with both changes NVD change history
Oct 7 – 26 Issue about the record opened and closed in the zlib repo madler/zlib#1330
Nov 4 – 6 Debian bug tracks CVE-2026-76844 against zlib Debian #1153063
Nov 7 Debian security advisory for zlib lists CVE-2026-76844 DSA-6613-1
← All posts