Postgresql: buffer overrun from integer overflow in array modification

published 2023-12-10 2 y ago modified 2026-11-04 4 d ago also BIT-postgresql-2023-5869 , EUVD-2023-58143 , JLSEC-2026-44

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 4.3%; EPSS 4.3% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5869 updated 2026-11-04 cvss 8.8

postgresql: Buffer overrun from integer overflow in array modification

Red Hat Enterprise Linux 6 postgresql, postgresql-libs, postgresql-test, postgresql-pltcl, postgresql-plperl, postgresql-server, +2 more
affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
Red Hat CodeReady Linux Builder (v. 9) postgresql-test 13.13-1.el9_3
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7784
Red Hat CodeReady Linux Builder EUS (v.9.0) postgresql-test 13.13-1.el9_0
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7545
Red Hat CodeReady Linux Builder EUS (v.9.2) postgresql-test 13.13-1.el9_2
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7616
Red Hat Enterprise Linux AppStream (v. 8) pgaudit 1.4.0-5.module+el8.9.0+19330+c97ddbdf, pgaudit 1.5.0-1.module+el8.9.0+20664+9c30cf7f, pgaudit 1.7.0-1.module+el8.9.0+19797+c4ce5969, pg_repack 1.4.6-3.module+el8.9.0+19330+c97ddbdf, pg_repack 1.4.6-3.module+el8.9.0+20664+9c30cf7f, pg_repack 1.4.8-1.module+el8.9.0+19797+c4ce5969, +40 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7714
Red Hat Enterprise Linux AppStream (v. 9) postgresql 13.13-1.el9_3, postgresql-pltcl 13.13-1.el9_3, postgresql-plperl 13.13-1.el9_3, postgresql-server 13.13-1.el9_3, postgresql-contrib 13.13-1.el9_3, postgresql-upgrade 13.13-1.el9_3, +15 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7785
Red Hat Enterprise Linux AppStream AUS (v. 8.2) pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661, postgresql 10.21-3.module+el8.2.0+20828+77647308, postgresql 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-test 10.21-3.module+el8.2.0+20828+77647308, postgresql-test 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-pltcl 10.21-3.module+el8.2.0+20828+77647308, +14 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7667
Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7, postgresql 10.21-3.module+el8.4.0+20772+e1ad5372, postgresql 12.17-1.module+el8.4.0+20773+7c41d490, postgresql 13.13-1.module+el8.4.0+20774+68ad636d, postgresql-test 10.21-3.module+el8.4.0+20772+e1ad5372, +25 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7694

show 15 more

Red Hat Enterprise Linux AppStream E4S (v. 8.1) postgresql 10.21-3.module+el8.1.0+20812+774a9597, postgresql-test 10.21-3.module+el8.1.0+20812+774a9597, postgresql-pltcl 10.21-3.module+el8.1.0+20812+774a9597, postgresql-plperl 10.21-3.module+el8.1.0+20812+774a9597, postgresql-server 10.21-3.module+el8.1.0+20812+774a9597, postgresql-contrib 10.21-3.module+el8.1.0+20812+774a9597, +3 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7778
Red Hat Enterprise Linux AppStream E4S (v. 8.2) pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661, postgresql 10.21-3.module+el8.2.0+20828+77647308, postgresql 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-test 10.21-3.module+el8.2.0+20828+77647308, postgresql-test 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-pltcl 10.21-3.module+el8.2.0+20828+77647308, +14 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7667
Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7, postgresql 10.21-3.module+el8.4.0+20772+e1ad5372, postgresql 12.17-1.module+el8.4.0+20773+7c41d490, postgresql 13.13-1.module+el8.4.0+20774+68ad636d, postgresql-test 10.21-3.module+el8.4.0+20772+e1ad5372, +25 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7694
Red Hat Enterprise Linux AppStream EUS (v.8.6) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5, pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5, pg_repack 1.4.6-3.module+el8.5.0+11357+bcc62552, postgresql 10.21-3.module+el8.6.0+20829+33f4a2c9, postgresql 12.17-1.module+el8.6.0+20721+c66fb2f5, +27 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7666
Red Hat Enterprise Linux AppStream EUS (v.8.8) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5, pgaudit 1.7.0-1.module+el8.8.0+17071+aaaceaa4, pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5, pg_repack 1.4.6-3.module+el8.5.0+11357+bcc62552, pg_repack 1.4.8-1.module+el8.8.0+17071+aaaceaa4, +40 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7656
Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql 13.13-1.el9_0, postgresql-pltcl 13.13-1.el9_0, postgresql-plperl 13.13-1.el9_0, postgresql-server 13.13-1.el9_0, postgresql-contrib 13.13-1.el9_0, postgresql-upgrade 13.13-1.el9_0, +2 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7545
Red Hat Enterprise Linux AppStream EUS (v.9.2) postgresql 13.13-1.el9_2, postgresql-pltcl 13.13-1.el9_2, postgresql-plperl 13.13-1.el9_2, postgresql-server 13.13-1.el9_2, postgresql-contrib 13.13-1.el9_2, postgresql-upgrade 13.13-1.el9_2, +15 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7885
Red Hat Enterprise Linux AppStream TUS (v. 8.2) pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661, postgresql 10.21-3.module+el8.2.0+20828+77647308, postgresql 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-test 10.21-3.module+el8.2.0+20828+77647308, postgresql-test 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-pltcl 10.21-3.module+el8.2.0+20828+77647308, +14 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7667
Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7, postgresql 10.21-3.module+el8.4.0+20772+e1ad5372, postgresql 12.17-1.module+el8.4.0+20773+7c41d490, postgresql 13.13-1.module+el8.4.0+20774+68ad636d, postgresql-test 10.21-3.module+el8.4.0+20772+e1ad5372, +25 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7694
Red Hat Enterprise Linux Client (v. 7) postgresql 9.2.24-9.el7_9, postgresql-libs 9.2.24-9.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) postgresql 9.2.24-9.el7_9, postgresql-test 9.2.24-9.el7_9, postgresql-pltcl 9.2.24-9.el7_9, postgresql-plperl 9.2.24-9.el7_9, postgresql-server 9.2.24-9.el7_9, postgresql-contrib 9.2.24-9.el7_9, +2 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql 9.2.24-9.el7_9, postgresql-test 9.2.24-9.el7_9, postgresql-pltcl 9.2.24-9.el7_9, postgresql-plperl 9.2.24-9.el7_9, postgresql-server 9.2.24-9.el7_9, postgresql-contrib 9.2.24-9.el7_9, +2 more Red Hat Enterprise Linux Server (v. 7) postgresql 9.2.24-9.el7_9, postgresql-libs 9.2.24-9.el7_9, postgresql-test 9.2.24-9.el7_9, postgresql-pltcl 9.2.24-9.el7_9, postgresql-plperl 9.2.24-9.el7_9, postgresql-server 9.2.24-9.el7_9, +2 more Red Hat Enterprise Linux Server Optional (v. 7) postgresql-upgrade 9.2.24-9.el7_9 Red Hat Enterprise Linux Workstation (v. 7) postgresql 9.2.24-9.el7_9, postgresql-libs 9.2.24-9.el7_9, postgresql-test 9.2.24-9.el7_9, postgresql-pltcl 9.2.24-9.el7_9, postgresql-plperl 9.2.24-9.el7_9, postgresql-server 9.2.24-9.el7_9, +2 more

+1 more productsfewer

Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-upgrade 9.2.24-9.el7_9

fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7783
Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql10-postgresql 10.23-2.el7, rh-postgresql12-postgresql 12.17-1.el7, rh-postgresql13-postgresql 13.13-1.el7, rh-postgresql10-postgresql-libs 10.23-2.el7, rh-postgresql10-postgresql-test 10.23-2.el7, rh-postgresql12-postgresql-libs 12.17-1.el7, +28 more Red Hat Software Collections for RHEL(v. 7) rh-postgresql10-postgresql 10.23-2.el7, rh-postgresql12-postgresql 12.17-1.el7, rh-postgresql13-postgresql 13.13-1.el7, rh-postgresql10-postgresql-libs 10.23-2.el7, rh-postgresql10-postgresql-test 10.23-2.el7, rh-postgresql12-postgresql-libs 12.17-1.el7, +28 more
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:7771
Red Hat RHACS 3.74 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 3.74.8-9, advanced-cluster-security/rhacs-operator-bundle 3.74.8-7, advanced-cluster-security/rhacs-central-db-rhel8 3.74.8-9, advanced-cluster-security/rhacs-scanner-db-rhel8 3.74.8-9, advanced-cluster-security/rhacs-scanner-db-slim-rhel8 3.74.8-9
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0304
Red Hat RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.1.6-6, advanced-cluster-security/rhacs-operator-bundle 4.1.6-6, advanced-cluster-security/rhacs-central-db-rhel8 4.1.6-6, advanced-cluster-security/rhacs-scanner-db-rhel8 4.1.6-6, advanced-cluster-security/rhacs-scanner-db-slim-rhel8 4.1.6-6
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0332
Red Hat RHACS 4.2 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.2.4-6, advanced-cluster-security/rhacs-operator-bundle 4.2.4-7, advanced-cluster-security/rhacs-central-db-rhel8 4.2.4-6, advanced-cluster-security/rhacs-scanner-db-rhel8 4.2.4-6, advanced-cluster-security/rhacs-scanner-db-slim-rhel8 4.2.4-7
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:0337
Red Hat Enterprise Linux 8 pgaudit, pg_repack, postgresql, postgresql-test, postgresql-pltcl, postgresql-plperl, +7 more Red Hat Enterprise Linux 9 postgresql, postgresql-test, postgresql-pltcl, postgresql-plperl, postgresql-server, postgresql-contrib, +4 more Red Hat RHACS 3.74 for RHEL 8 advanced-cluster-security/rhacs-roxctl-rhel8 3.74.8-9, advanced-cluster-security/rhacs-scanner-rhel8 3.74.8-9, advanced-cluster-security/rhacs-rhel8-operator 3.74.8-9, advanced-cluster-security/rhacs-collector-rhel8 3.74.8-9, advanced-cluster-security/rhacs-scanner-slim-rhel8 3.74.8-9, advanced-cluster-security/rhacs-collector-slim-rhel8 3.74.8-8 Red Hat RHACS 4.1 for RHEL 8 advanced-cluster-security/rhacs-roxctl-rhel8 4.1.6-6, advanced-cluster-security/rhacs-scanner-rhel8 4.1.6-6, advanced-cluster-security/rhacs-rhel8-operator 4.1.6-6, advanced-cluster-security/rhacs-collector-rhel8 4.1.6-3, advanced-cluster-security/rhacs-scanner-slim-rhel8 4.1.6-6, advanced-cluster-security/rhacs-collector-slim-rhel8 4.1.6-6 Red Hat RHACS 4.2 for RHEL 8 advanced-cluster-security/rhacs-roxctl-rhel8 4.2.4-6, advanced-cluster-security/rhacs-scanner-rhel8 4.2.4-6, advanced-cluster-security/rhacs-rhel8-operator 4.2.4-6, advanced-cluster-security/rhacs-collector-rhel8 4.2.4-7, advanced-cluster-security/rhacs-scanner-slim-rhel8 4.2.4-7, advanced-cluster-security/rhacs-collector-slim-rhel8 4.2.4-7
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-120-06 updated 2026-04-30 cvss 8.8

ABB Ability Symphony Plus Engineering

ABB S+ Engineering 2.2, 2.3, 2.3_RU1, 2.3_RU2
affected: vendor fix, workaround, mitigation
ABB S+ Engineering 2.4_SP2_RU1
fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-228-06 updated 2024-08-13 cvss 8.8

Siemens SINEC NMS

Siemens SINEC NMS <V3.0
affected: fixed in V3.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 d ago (2026-11-02)

Exploit prediction

4.32% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	postgresql	>=11.0.0, <11.22.0 >=12.0.0, <12.17.0 >=13.0.0, <13.13.0 >=14.0.0, <14.10.0 >=15.0.0, <15.5.0 >=16.0.0, <16.0.1	11.22.0 12.17.0 13.13.0 14.10.0 15.5.0 16.0.1
julia	LibPQ_jll	<16.8.0+0	16.8.0+0

Affected products

Red Hat Red Hat Advanced Cluster Security 4.2
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service
Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
Red Hat Red Hat Software Collections for Red Hat Enterprise Linux 7
Red Hat RHACS-3.74-RHEL-8
Red Hat RHACS-4.1-RHEL-8
Red Hat Red Hat Enterprise Linux 6

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

Technology feeds

PostgreSQL rss critical rss

References

access.redhat.com /errata/RHSA-2023:7545
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7579
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7580
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7581
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7616
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7656
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7666
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7667
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7694
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7695
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7714
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7770
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7771
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7772
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7778
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7783
vendor-advisory, third-party-advisory, advisory, web
access.redhat.com /errata/RHSA-2023:7784
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7785
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7786
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7788
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7789
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7790
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7878
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7883
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7884
vendor-advisory, web
access.redhat.com /errata/RHSA-2023:7885
vendor-advisory, web
access.redhat.com /errata/RHSA-2024:0304
vendor-advisory, web
access.redhat.com /errata/RHSA-2024:0332
vendor-advisory, web
access.redhat.com /errata/RHSA-2024:0337
vendor-advisory, web
postgresql.org /support/security/CVE-2023-5869/
vendor-advisory, advisory, web
access.redhat.com /security/cve/CVE-2023-5869
vdb-entry, third-party-advisory, advisory, web
bugzilla.redhat.com /show_bug.cgi?id=2247169
issue-tracking, report, web
postgresql.org /about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
release-notes, article, web
security.netapp.com /advisory/ntap-20240119-0003/
web
lists.debian.org /debian-lts-announce/2023/11/msg00007.html
web
nvd.nist.gov /vuln/detail/CVE-2023-5869
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix