CSAF and CVE Record list different affected versions for same advisory

Hello, I am comparing the affected version lists published by Cisco in two formats for the same advisory, and I consistently find a difference. I would like to understand whether this is expected. == Example 1: cisco-sa-asa-ftd-ios-dos-kPEpQGGK / CVE-2026-20012 == CSAF (product_status.known_affected, relationships expanded) : 1,429 versions CVE Record (containers.cna.affected[].versions) : 1,271 versions Versions present in CSAF but not in the CVE Record : 158 The CVE Record is a strict subset of the CSAF.