Data quality issue with CVE-2026-57819

[sonpoas]

The CVE ID

https://osv.dev/vulnerability/CVE-2026-57819

Describe the data quality issue observed

The CVE v5 record identifies a specific Maven package:

• collectionURL: https://repo.maven.apache.org/maven2
• packageName: org.apache.cxf:cxf-rt-frontend-jaxrs
• affected versions:
  • >= 4.2.0, < 4.2.3
  • >= 4.0.0, < 4.1.8
  • < 3.6.12

Source:
https://www.cve.org/CVERecord?id=CVE-2026-57819

However, the generated OSV record has no affected[].package object. It contains only a GIT range for the entire https://github.com/apache/cxf repository.

The package version ranges from the CVE record appear only under database_specific.unresolved_ranges with source AFFECTED_FIELD.

As a result, the record is classified under the GIT ecosystem instead of Maven.

Suggested changes to record

Create an affected entry for the Maven package, for example:

{
  "package": {
    "ecosystem": "Maven",
    "name": "org.apache.cxf:cxf-rt-frontend-jaxrs",
    "purl": "pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxrs"
  },
  "ranges": [
    {
      "type": "ECOSYSTEM",
      "events": [
        {"introduced": "0"},
        {"fixed": "3.6.12"},
        {"introduced": "4.0.0"},
        {"fixed": "4.1.8"},
        {"introduced": "4.2.0"},
        {"fixed": "4.2.3"}
      ]
    }
  ]
}

The record should be included in the Maven ecosystem.

Additional context

This appears closely related to #3582, which requested that the CVE v5 converter preserve collectionURL, packageName, and affected version information:

#3582

That issue was closed as completed, but this recently generated record still drops those fields.

[github-actions]

✨ Thank you for your interest in OSV.dev's data quality! ✨

Please review our FAQ entry on how to most efficiently have this addressed.