GET /api/v1/vulnerability/project/{uuid} returns only unique CVE IDs in v5.0.2

[Tadao0501]

Current Behavior

The v5.0.2 API server returns only unique CVEs.
In contrast, the v4.14.2 API server returns vulnerabilities including duplicate CVE IDs.

attached files:

• 113CVEs.txt: Output from GET /api/v1/vulnerability/project/{uuid} on v5.0.2
• 119CVEs.txt: Vulnerability list shown in the v5.0.2 frontend Audit Vulnerabilities view
• VDR.json: VDR exported from v5.0.2; all 119 CVEs are included

113CVEs.txt
119CVEs.txt
VDR.json

Steps to Reproduce

1. Create a project for testing.
2. Open the "Components" tab of the project.
3. Upload the attached SBOM_two_LibTIFF_versions.json using "Upload BOM".
4. Wait until approximately 119 vulnerabilities (CVEs) have been identified.
5. Retrieve the project's vulnerabilities using GET /api/v1/vulnerability/project/{uuid}.

SBOM_two_LibTIFF_versions.json

Expected Behavior

The frontend UI, exported VDR, and API endpoint should all return the same number of CVEs.
The API should return the same 119 CVEs as the frontend UI and the exported VDR.

Dependency-Track Version

5.x

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported