CVE ID should be different to the rust-lang.org one.

[rbtcollins]

This is on me, but I didn't get the right pattern for referring to the Rust CVE vs this CVE - are we able to get the advisory to have its own distinct CVE? @pietroalbini advises that scanners could be confused by the same CVE ID being used, and since the point of the vuln system is to let people know when they have to fix something, we should help them as much as possible,

[pietroalbini]

Not sure if you can request an ID from GitHub once the advisory has been published, but it should be possible at least to remove the CVE ID from the advisory before it's picked up by dependabot.

[XAMPPRocky]

I have removed it, let me know if there's something it should be.

[pietroalbini]

Thanks! In theory a new CVE ID should be requested, not sure if GitHub allows doing so after the advisory is public. Worst case go through MITRE.