https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm & https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc have each other as aliases, along with their related CVEs.
Firstly, the schema says:
The aliases field gives a list of IDs of the same vulnerability in other databases, in the form of the id field. This allows one database to claim that its own entry describes the same vulnerability as one or more entries in other databases.
Taking that literally means its invalid for an advisory to list another advisory within the same database as an alias, which is what's happening here.
Beyond that, I cannot find a link between these two records via their advisory & aliases (I've not checked all the downstream stuff as there's a lot of them 🙃 but I assume they shouldn't be factored in cause it's down stream) - the only link I can find is that GHSA-r5fr-rjxr-66jc says "The fix for CVE-2021-23337 added ..." in its details
https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm & https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc have each other as aliases, along with their related CVEs.
Firstly, the schema says:
Taking that literally means its invalid for an advisory to list another advisory within the same database as an alias, which is what's happening here.
Beyond that, I cannot find a link between these two records via their advisory & aliases (I've not checked all the downstream stuff as there's a lot of them 🙃 but I assume they shouldn't be factored in cause it's down stream) - the only link I can find is that GHSA-r5fr-rjxr-66jc says "The fix for CVE-2021-23337 added ..." in its details