Five Feeds, One Truth? Cross-Source Consistency of Fix Status, Severity, and Identifier Mapping Across GHSA, NVD, and OSV

Abstract

Background: A single software vulnerability typically exists in four public records simultaneously: the CVE entry (CNA-authored), its NVD enrichment (CPE/CWE/CVSS), the GitHub Security Advisory (ecosystem-scoped, reviewed), and its OSV aggregation. These sources disagree — on affected version ranges, severity, and fix status — and consumers of vulnerability intelligence rarely reconcile them. Objective: We consolidate the published consistency evidence, formalize the inconsistency classes that matter to consumers, and assess the reconciliation mechanisms available in current tooling. Methods: Synthesis of the large-scale consistency literature (the VIEM measurement of 78,296 CVE/report pairs; the GHSA review-pipeline characterization), architectural analysis of the four-source data flow, and a six-class inconsistency-versus-reconciliation assessment. Results: The published record establishes that divergence is prevalent (only 59.82% of CVE/report pairs strictly matched NVD entries at VIEM's 2019 measurement, with inconsistency increasing over time), and the 2024-2026 structural changes — NVD enrichment triage, ADP parallel enrichment, GHSA's multi-source review pipeline — have multiplied the divergence surface. We identify six inconsistency classes and find that the strongest reconciliation mechanisms (canonical-record policies, field-level cross-validation) are organizational choices rather than shipped tooling: today's pipelines aggregate first and reconcile never. Conclusions: Cross-source consistency must become a measured property of vulnerability intelligence pipelines — with a declared canonical record, field-level validation, and time-stamped audits — or consumers will continue to receive silently conflicting answers to the same question.