Beyond One-Hop Aliases: Measuring Identifier-Resolution Fragmentation in the OSV Vulnerability Graph Across Six Package Ecosystems

Authors

Keywords:

OSV, vulnerability identifiers, alias resolution, vulnerability databases, software supply chain, graph analysis

Abstract

Background: Open-source vulnerability records connect source-native identifiers through aliases. The Open Source Vulnerability (OSV) specification treats aliases as symmetric and transitive, but consumers that stop at one record's directly listed identifiers may recover an incomplete equivalence set.

References

1. Open Source Security Foundation. Open Source Vulnerability format: schema specification. Versioned source commit 65280faa676c7a69bb9208d876b2419f88dd7e03. 2026. https://ossf.github.io/osv-schema/

2. Open Source Vulnerabilities. Data sources and per-ecosystem data dumps. 2026. https://google.github.io/osv.dev/data/

3. Y. Dong, W. Guo, Y. Chen, X. Xing, Y. Zhang, and G. Wang. Towards the Detection of Inconsistencies in Public Security Vulnerability Reports. In: 28th USENIX Security Symposium, pp. 869–885, 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/dong

4. A. Anwar, A. Abusnaina, S. Chen, F. Li, and D. Mohaisen. Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses. IEEE Transactions on Dependable and Secure Computing 19(6), 4255–4269, 2022. https://doi.org/10.1109/TDSC.2021.3125270

5. Y. Jiang, M. Jeusfeld, and J. Ding. Evaluating the Data Inconsistency of Open-Source Vulnerability Repositories. In: Proceedings of the 16th International Conference on Availability, Reliability and Security, 2021. https://doi.org/10.1145/3465481.3470093

6. R. Croft, M. A. Babar, and M. M. Kholoosi. Data Quality for Software Vulnerability Datasets. In: 45th IEEE/ACM International Conference on Software Engineering, 2023. https://doi.org/10.1109/ICSE48619.2023.00022

7. B. Boles, C. Izurieta, and A. M. Reinhold. Connecting the Dots: An Integrated Vulnerability Knowledge Graph for Security Practitioners. In: 2025 IEEE International Conference on Information Reuse and Integration and Data Science, 2025. https://doi.org/10.1109/IRI66576.2025.00050

8. J. Wunder, A. Corona, A. Hammer, and Z. Benenson. On NVD Users’ Attitudes, Experiences, Hopes, and Hurdles. Digital Threats: Research and Practice 5(3), 1–19, 2024. https://doi.org/10.1145/3688806

Cybersecurity Advances, Volume 3, Issue 1, 2026 cover for 2026: Vulnerability Intelligence in Operational Systems.

Downloads

Published

2026-10-30

Issue

Vol. 3 No. 1 (2026): 2026: Vulnerability Intelligence in Operational Systems

Section

Articles

License

Copyright (c) 2026 The author(s)

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.