brew vulns report false positive package flagged for legacy OSV (2023)

[enyofthenorth]

brew doctor output

$ brew doctor
Your system is ready to brew.

Verification

• I ran brew update twice and am still able to reproduce my issue.
• I have supplied my brew doctor output above and it seems unrelated to my issue.
• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.
• I did not use AI/LLM to create this issue, or I disclosed the tool and model used; I will answer maintainer questions myself without AI/LLM.

brew config output

HOMEBREW_VERSION: 7.0.6
ORIGIN: https://github.com/Homebrew/brew
HEAD: 570982948a8a194f0f42f43f4a5bce2d1c9f64cb
Last commit: 21 hours ago
Branch: stable
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.7
CPU: deca-core 64-bit arm_firestorm_icestorm
Clang: 21.0.0 build 2100
Git: 2.54.0
Curl: 8.7.1
macOS: 26.7-arm64
CLT: 27.0.0.0.1788430756
Xcode: N/A
Rosetta 2: false

What were you trying to do (and why)?

I did check does any of installed formulas contain vulnerabilities.

This is reported to https://github.com/Homebrew/brew because of below statements.

At https://github.com/Homebrew/homebrew-brew-vulns

It has been entirely merged into Homebrew/brew as a built-in command.

At Homebrew/homebrew-brew-vulns#41

May 23, 2026, 20:25 GMT+3 - andrew: Please reopen if you see this again

What happened (include all command output)?

$ brew vulns

icu4c@78 (78.3)
  OSV-2023-1328 (HIGH) - Stack-buffer-overflow in icu_75::TZDBTimeZoneNames::getMetaZ...

Found 1 vulnerabilities in 1 packages

What did you expect to happen?

$ brew vulns

Found 0 vulnerabilities in 0 packages

Step-by-step reproduction instructions (running brew commands)

brew install icu4c@78
brew vulns

[MikeMcQuaid]

@enyofthenorth You've not provided enough information here, sorry. Can you please explain why this should not be showing the specific vulnerability? Provide as much information/links/data as possible, thanks.

[enyofthenorth]

Vulnerability is reported from OSV.dev database for unicode-org/icu release-78.3

--> This is after all not a false positive from Homebrew/brew

My apologies for not noting release-78.3 (as separately located at the end of version table) at https://osv.dev/vulnerability/OSV-2023-1328

Closing #24070 as issue not originating from Homebrew/brew

Further discussion of OSV.dev database state regarding unicode-org/icu release-78.3 at unicode-org/icu#2752 (comment)