Data quality issue with CVE-2026-111171 #6181

The CVE ID
https://osv.dev/vulnerability/CVE-2026-111171

Describe the data quality issue observed
The record lists GHSA-5hr4-253g-cpx2 in aliases, but the CNA record tags that reference related and vendor-advisory. CVE-2026-111171 is a bypass of the CVE-2026-40072 fix (IPv4-mapped IPv6 addresses in _check_ip_blocked()), not the same vulnerability. Through alias grouping, OSV.dev now returns CVE-2026-111171 as an alias of CVE-2026-40072, GHSA-5hr4-253g-cpx2 and PYSEC-2026-3414, so consumers that merge alias groups report the bypass as fixed in web3 7.15.0.

The GIT range also sets fixed at v7.16.0 (efbc6ebc) and v8.0.0 (c8c1ed0c), but the CNA record lists 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 as affected (lessThanOrEqual), so both releases are affected. The second interval starts at introduced: "0" rather than 8.0.0b2.

Suggested changes to record
Drop GHSA-5hr4-253g-cpx2 from aliases (at most related). Use last_affected for v7.16.0 and v8.0.0, and start the second interval at v8.0.0-beta.2 (f293950722).

Additional context
This surfaced while reviewing a Homebrew advisory candidate for slither-analyzer, which bundles web3 7.16.0.