A vulnerability could spread from one software to downstream software projects that import/use the software. If the original software has already requested a CVE ID and disclosed the vulnerability to the public, does its downstream software also need to report the vulnerability and request separate CVE IDs for their own projects on the same vulnerability?
This likely would lead to a huge amount of duplicate records in the vulnerability database. However, I also could not find an official language or reporting guidelines on the CVE website that explicitly indicates that downstream software should not report vulnerabilities caused by their dependencies.
For example, if my software project imports an external software library that disclosed a vulnerability, do I need to request a CVE ID for my own software and report a vulnerability that I once imported to the vulnerable library in my software that made my software vulnerable?