One vulnerability can have several identifiers. A CVE is the widely used public name, a GHSA is an ID from the GitHub Advisory Database, and OSV entries carry their own IDs and list the others as aliases. Record the one your tools use, plus every alias, so you can match records across sources.
What each one is
- CVE. A public identifier for a vulnerability, used across vendors and databases.
- GHSA. An identifier in the form GHSA followed by three groups of letters and digits, assigned by the GitHub Advisory Database. Reviewed advisories have been checked for validity and carry package and ecosystem details. Unreviewed ones come automatically from the National Vulnerability Database feed and are not checked for completeness.
- OSV ID. The OSV schema defines a common format. Each entry has an ID from its source database and can list aliases, related IDs and a withdrawn time.
What the OSV fields mean
| Field | Meaning |
|---|---|
| aliases | Other IDs for the same flaw. Two entries are aliases if they affect a component the same way |
| related | Closely related vulnerabilities that are not the same flaw |
| withdrawn | When the entry should be considered withdrawn. If absent, it has not been |
| fixed event | The version that contains the fix |
Aliases are symmetric and transitive. Related is symmetric but not transitive, so do not merge related entries into one finding.
Why it matters
- Deduplication. Two scanners may report the same flaw under different IDs. Aliases let you count it once.
- Missing CVE. Some open source advisories have no CVE. If you search by CVE only, you miss them.
- Withdrawn entries. A finding that was withdrawn should not stay open in your backlog.
- Evidence. Auditors and customers may search by CVE, so keep it in the record when one exists.
What to record in a ticket
- The ID your scanner used.
- All aliases, with the CVE first when there is one.
- Package, ecosystem, installed version and fixed version.
- A link to the advisory.
- Status of withdrawn, if applicable.
A short example of matching
Suppose scanner A reports a flaw by its GHSA ID and scanner B reports it by CVE. If both records list each other as aliases, you can merge them into one finding with one owner and one due date. If one record lacks the alias, you may open two tickets for the same fix. Normalise on a primary ID in your tracker, and store the aliases in a field so searches by either ID find the same ticket.
Quick check
Is a GHSA the same as a CVE?
Not the same identifier. They often describe the same flaw and link to each other. Advisories sourced from the National Vulnerability Database link to the corresponding CVE record.
What if an advisory has no CVE?
Track it by its GHSA or OSV ID. A missing CVE does not make the flaw less real.
Where Safeguard fits
Safeguard's dependency scanning records findings with their identifiers and fixed versions. You can look at that record in a free scan.
Sources
- GitHub Docs, About the GitHub Advisory Database (GHSA format, reviewed and unreviewed advisories).
- OSV schema, ossf.github.io/osv-schema (aliases, related, withdrawn, fixed).
Last reviewed: 19 October 2026.
