CVE-2026-40609 is duplicate of CVE-2026-34463

[dregad]

CVE-2026-40609 was assigned by GitHub in GHSA-rjvr-hf8j-jg2h.

The advisory turned out to be a duplicate of GHSA-fvjf-68wh-rwp2 (not yet published), for which CVE-2026-34463 was previously assigned, which I unfortunately failed to notice at the time I requested the new CVE.

GHSA-rjvr-hf8j-jg2h was closed without publication, with a comment reflecting the above. As I got no response from that and not being sure about the normal process for this, I'm posting here. If this is not the right way to do things, please advise.

Could CVE-2026-40609 be flagged as invalid / duplicate ?

Thanks in advance.

[taladrane]

👋 thank you for letting us know! We've gone ahead and rejected CVE-2026-40609, and I've taken some internal notes on how we could make this easier for maintainers in the future. Creating an issue in this repository to let us know is fine, or reaching out to us at our CNA contact email address also works.

Thank you again!

[dregad]

Thanks for the feedback @taladrane

Creating an issue in this repository to let us know is fine, or reaching out to us at our CNA contact email address also works.

Maybe you could simply add a paragraph in the CVE ID attribution message, referencing these communication channels ?