There are two CPE's that aren't actually known by NIST so don't connect to any CVE's. It has been seen that some scanners only scan the first CPE, though this is incorrect, it is leading to a large miss in CVE's because of those incorrect CPE's. Removing these CPE's will help improve this while also ensuring the metadata is fully accurate.
No need to reply here but just for completeness, I mentioned at https://github.com/gentoo/gentoo/pull/31078#discussion_r1199554985 that I'm a bit concerned: """ I'm a bit worried about this because Daniel is actively trying to move away from the haxxe name for curl purposes and scanners (as you noted in your bug) should really go for any-of. """
