The current implementation of VulnerabilityReference , forces us to have only one reference_id and url which is inconvenient because consider : for vulneraiblity 'a' there are 'n' reference_id and 'm' url , hence to have all combinations of reference_id and url we need to create n*m VulnerabilityReference. This results in more db queries+ data duplication.
This can be simply solved by using ArrayField