Debian unstable release not handled correctly

[n2b12]

It appears data on osv.dev indicate that all versions of Debian 12 and 13 package 7zip are vulnerable:
Debian {12-13} / Affected versions / 26.*:

26.00+dfsg-1
26.00+dfsg-2
26.00+dfsg-3
26.00+dfsg-4
26.00+dfsg-5
26.00+dfsg1-1
26.00+dfsg1-2
26.00+dfsg1-3
26.01+dfsg-1
26.01+dfsg-2
26.01+dfsg-3
26.02+dfsg-1 <--- BUG
26.02+dfsg

Debian's CVE tracker states affected versions are:

Bookworm (12) 22.01+really26.01+dfsg-0+deb12u1
Trixie (13) 25.01+dfsg-1~deb13u2
and fix is introduced in 26.02+dfsg-1

Similarly, for package p7zip for Debian 12 data on osv.dev states affected version are:

16.02+dfsg-8
16.02+really25.01+dfsg-0+deb12u1
16.02+really26.01+dfsg-0+deb12u1
16.02+transitional.1 <--- BUG

While Debian states fixed version is 16.02+transitional.1

[jess-lowe]

link to osv record in prod and test for when i have the time to look at this later

[jess-lowe]

oh. these are on the unstable version.

related to case 3 in #4161