OSV vulnerabilities with severity in `ecosystem_specific` field but no overall severity field

go.json

{"id":"OSV-2021-1658","summary":"Null-dereference READ in istio.io/istio/security/pkg/util.ExtractJwtAud","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42142\n\nCrash type: Null-dereference READ\nCrash state:\nistio.io/istio/security/pkg/util.ExtractJwtAud\n","modified":"2021-12-10T00:00:22.916922Z","published":"2021-12-10T00:00:22.916670Z","withdrawn":"2022-02-18T04:38:40.835086Z","references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42142"}],"affected":[{"package":{"name":"istio","ecosystem":"Go","purl":"pkg:golang/istio"},"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/istio/OSV-2021-1658.yaml"},"versions":[]}],"schema_version":"1.6.0","_id":"gOdrRETflTeUkPLY"}

pypi.json

{"id":"OSV-2021-1809","summary":"Heap-buffer-overflow in ujson.cpython-38-x86_64-linux-gnu.so","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44973\n\n```\nCrash type: Heap-buffer-overflow WRITE 1\nCrash state:\nujson.cpython-38-x86_64-linux-gnu.so\nujson.cpython-38-x86_64-linux-gnu.so\nujson.cpython-38-x86_64-linux-gnu.so\n```\n","modified":"2022-05-19T00:55:00.970552Z","published":"2022-02-25T00:00:25.106722Z","references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44973"}],"affected":[{"package":{"name":"ujson","ecosystem":"PyPI","purl":"pkg:pypi/ujson"},"ranges":[{"type":"GIT","repo":"https://github.com/ultrajson/ultrajson.git","events":[{"introduced":"b9275f7b001da11495040f1332f6c3adf3daa57b"},{"fixed":"f6860f1f3d8d4e92b9be0e5815355a8976c6e75b"},{"fixed":"550ba4d77294e61597a5259d00769c61281e0042"}]}],"versions":["5.1.0"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-1809.yaml"}}],"schema_version":"1.6.0","_id":"8kjVyJ5ptwsmxr0D"}
{"id":"OSV-2021-955","summary":"Stack-buffer-overflow in Buffer_AppendIndentUnchecked","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009\n\n```\nCrash type: Stack-buffer-overflow WRITE 1\nCrash state:\nBuffer_AppendIndentUnchecked\nencode\nencode\n```\n","modified":"2022-05-19T00:45:08.957102Z","published":"2021-07-11T00:01:05.153778Z","references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009"}],"affected":[{"package":{"name":"ujson","ecosystem":"PyPI","purl":"pkg:pypi/ujson"},"ranges":[{"type":"GIT","repo":"https://github.com/ultrajson/ultrajson.git","events":[{"introduced":"0c52200eb4e2d97e548a765d5f089858c41967b0"},{"fixed":"f6860f1f3d8d4e92b9be0e5815355a8976c6e75b"},{"fixed":"5525f8c9ef8bb879dadd0eb942d524827d1b0362"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","3.0.0","3.1.0","3.2.0","4.0.0","4.0.1","4.0.2","4.1.0","4.2.0","4.3.0","5.0.0","5.1.0","v1.34","v1.35"],"ecosystem_specific":{"severity":"HIGH"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ujson/OSV-2021-955.yaml"}}],"schema_version":"1.6.0","_id":"cu0EpuCHlTKHEJYR"}
{"id":"OSV-2023-885","summary":"UNKNOWN READ in bytes1_char_at","details":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62508\n\n```\nCrash type: UNKNOWN READ\nCrash state:\nbytes1_char_at\nascii_at_line_end\ntry_match\n```\n","modified":"2023-09-20T14:02:30.557630Z","published":"2023-09-20T14:02:30.557328Z","references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62508"}],"affected":[{"package":{"name":"mrab-regex","ecosystem":"PyPI","purl":"pkg:pypi/mrab-regex"},"ranges":[{"type":"GIT","repo":"https://github.com/mrabarnett/mrab-regex","events":[{"introduced":"1e6986b92f978087eb34ca79732d3b0c45be8652"},{"fixed":"cdcbf36aebb0e5d54072bd96a6fe4932f1fd6ae0"}]}],"versions":["2021.11.10","2022.1.18","2022.10.31","2022.3.15","2022.3.2","2022.4.24","2022.6.2","2022.7.24","2022.7.25","2022.7.9","2022.8.17","2022.9.11","2022.9.13","2023.03.22","2023.10.3","2023.3.22","2023.3.23","2023.5.2","2023.5.3","2023.5.4","2023.5.5","2023.6.3","2023.8.8"],"ecosystem_specific":{"severity":"MEDIUM"},"database_specific":{"source":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mrab-regex/OSV-2023-885.yaml"}}],"schema_version":"1.6.0","_id":"vzwyaAdpGw5SaTeZ"}

What's done here:

if 'severity' not in entry and 'ecosystem_specific' in entry and 'severity' in entry['ecosystem_specific']:
    print(f"Entry missing 'severity' but has 'ecosystem_specific.severity' at line {l}")

Eyeballing these, the severity specified in ecosystem_specific doesn't map to anything supported by the top-level severity field...