Repository navigation
grouper.Group misses transitive alias relations when the linking record comes last #3107
Description
grouper.Group (internal/grouper/grouper.go) merges two records that share an alias by writing groups[i] = min(groups[i], groups[j]) against the two indices, not against the groups those indices already belong to. When the record that links two existing groups comes after both of them, only the later index is re-pointed and the earlier group's other members stay behind, so records that describe one vulnerability are reported as two groups.
Reproduction against main at f0e28d3, in internal/grouper:
func TestGroupTransitive(t *testing.T) {
got := grouper.Group([]grouper.IDAliases{
{ID: "GHSA-aaaa", Aliases: []string{"CVE-1"}},
{ID: "GHSA-bbbb", Aliases: []string{"CVE-3"}},
{ID: "GHSA-cccc", Aliases: []string{"CVE-2", "CVE-3"}},
{ID: "GHSA-dddd", Aliases: []string{"CVE-1", "CVE-2"}},
})
if len(got) != 1 {
t.Fatalf("want 1 group, got %d: %v", len(got), got)
}
}Expected: one group holding all four IDs, since aaaa and dddd share CVE-1, cccc and dddd share CVE-2, and bbbb and cccc share CVE-3.
Actual: two groups, [GHSA-aaaa GHSA-cccc GHSA-dddd] and [GHSA-bbbb].
Where it shows: pkg/osvscanner/vulnerability_result.go builds pkg.Groups from this function, so every output that reads Groups reports one vulnerability as two groups whenever the alias sets overlap in a chain rather than pairwise, which is the shape distribution advisories produce once their upstream CVEs are folded into aliases (#2027). It is order dependent: the same four records in a different order group correctly.
Activity
G-Rath commentedon Sep 26, 2026
Do you have a reproduction with real world advisories using the CLI or library?
lenamonj commentedon Sep 27, 2026
Yes. Four Ubuntu Pro livepatch advisories for
linux, fetched fromapi.osv.dev/v1/vulns/and passed through the same two callspkg/osvscanner/vulnerability_result.gomakes:G-Rath commentedon Sep 27, 2026
That's not a reproduction though that uses the public API
lenamonj commentedon Sep 27, 2026
Debian
linux5.10.46-4 through the CLI, the v2.6.0 release binary and a build of main at f0e28d3 printing the same lines, OSV data as of 2026-09-27 10:10 UTC:DSA-6126-1 and DEBIAN-CVE-2024-58096 both list CVE-2024-58096 in
upstream, whichConvertVulnerabilityToIDAliasesfolds into aliases, so by the scanner's own rule they share an alias, yet the scan puts that alias in two groups, one holding each record. The same scan with the fix applied gives 14449 groups, and the second query prints[2663,true,true].test: add fixture for grouping advisories that only shared an upstream (
fix(output): group vulnerabilities transitively regardless of order (#…