Why need this Task?

This is causing misidentifications of affected products

Description:

We've encountered modular product ID with the format of module/package. For example, ubi10/s2i-core in https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24294.json. However, for CVE-2023-5841, the package gimp:flapak/OpenEXR is represented in package:module format (OpenEXR-libs::gimp:flatpak in https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-5841.json).

This causes our feed parser to miss it and mark the whole package as vulnerable instead of only the modular one.

Can you let us know how we should approach this or is this something that RedHat can address?