A CVE record can hold references in more than one container. Since 31 July 2024 the CVE Program adds its own references in a separate CVE Program container, while the CNA keeps its own, so the same link can appear twice. If you ingest CVE data, read both containers and deduplicate by URL.
Where the duplicates come from
The cvelistV5 repository explains the change. CVE Records may now consist of several containers: a CNA container, the CVE Program container, and optional ADP containers. All references added by the Program after 31 July 2024 live in the Program container, and CNA references stay in the CNA container.
The Program container is built in the ADP container format. Its title is "CVE Program Container", and it carries a references list in the same format as a CNA's.
The repository also describes a one-time copy: references read from the CNA container on 31 July 2024 were copied into the Program container with an x_transferred tag, to preserve the state of the CNA's list on that date. References added later do not carry that tag. For new records created after that date, if no Program-provided data is added, no Program container exists at all.
It states plainly that "the possibility of reference duplications is an artifact of having more than one organization providing references in separate locations", and that downstream users must decide how to resolve them.
What this means if you ingest records
| Situation | What you see |
|---|---|
| Older record, copied on 31 July 2024 | Same URL in both containers; Program copy tagged x_transferred |
| Newer record, no Program data | Only a CNA container |
| Record enriched later | Extra Program references, maybe also in CNA list |
| ADP present | More containers with more references |
Reading only the CNA container can miss references; reading only the Program container misses CNA ones. The repository says that to obtain the core information, tool vendors and users need to examine the CNA container and the Program container, if one exists.
A merge routine
- Collect references from the CNA container, the Program container and each ADP container.
- Normalize each URL: lower-case the host, trim fragments and trailing slashes where safe.
- Group by normalized URL.
- Union the tags across copies. If one copy says patch and another has none, keep patch.
- Keep the source container name for each reference, for traceability.
- Drop the x_transferred marker from user display; it is a bookkeeping tag.
Tags matter for finding fixes, so merge them carefully. See CVE reference tags and finding the patch.
Why a person should care
If you show "12 references" in a dashboard and ten are duplicates, a reviewer wastes time. If a rule counts references as a proxy for importance, duplicates inflate it. Counting by unique URL avoids that.
The same principle applies to other fields. Our posts on who can add information to a CVE record and CNA and ADP containers show where scores and data live.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning. When you use any tool, ask whether it merges references from every container. You can try the free scan at gold.safeguard.sh/scan.
Quick check
What is the CVE Program container?
An ADP-format container, titled "CVE Program Container", that holds references the Program added after 31 July 2024.
What does the x_transferred tag mean?
It marks references copied one time from the CNA container on 31 July 2024.
Do I need to read both containers?
Yes, according to the repository, to obtain the core information.
Sources
- CVE Program, cvelistV5 repository README, fetched 19 October 2026.
Last reviewed: 19 October 2026.
