RUSTSEC advisories that don't have a CVE don't show up in UI

I set up trustify and enabled the RUSTSEC import.
The UI only shows me CVE-20xx-xxx vulnerabilities, and advisories like RUSTSEC-2026-0312 are missing
I imported an SBOM for a Rust project that has a dependency vulnerable to RUSTSEC-2026-0312
The UI shows that my SBOM has no vulnerable dependencies

We discussed this on Matrix, and

trustify/modules/ingestor/src/service/advisory/osv/loader.rs

Lines 56 to 66 in 0b3bc0b

    
           let cve_ids: Vec<String> = osv 
        
               .aliases 
        
               .iter() 
        
               .flat_map(|aliases| { 
        
                   aliases 
        
                       .iter() 
        
                       .filter(|e| e.starts_with("CVE-")) 
        
                       .cloned() 
        
                       .collect::<Vec<_>>() 
        
               }) 
        
               .collect();

was highlighted as a possible cause.

Version

$ trustd --version
trustify-trustd 0.6.2

@rh-jfuller

@rh-jfuller, as you mentioned on the aforementioned discussion, it would be great to highlight where the UX might be lacking, thanks.

TC-6801 is tracking this internally - from a ux pov basically we need to not filter on just CVE- (and prob provide default filters on vuln type) on the vulnerability page ... but this needs to be done as part of a larger set of changes that reinforce difference between vulns sourced from an 'advisory' ... versus the all important CSAF VEX advisory ... the ux definition will be a side effect of any new backend work.

@ctron

@ctron stated that it is in #2693; Caution: Potentially dead path as database scheme might change!

Navigation Menu

Repository navigation

RUSTSEC advisories that don't have a CVE don't show up in UI #2723

Version

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	let cve_ids: Vec<String> = osv
	.aliases
	.iter()
	.flat_map(\|aliases\| {
	aliases
	.iter()
	.filter(\|e\| e.starts_with("CVE-"))
	.cloned()
	.collect::<Vec<_>>()
	})
	.collect();

RUSTSEC advisories that don't have a CVE don't show up in UI #2723

Description

Version

Activity

gildub commented on Sep 30, 2026

rh-jfuller commented on Oct 8, 2026

tschmidtb51 commented on Oct 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions