OSSIndexAnalyzer cannot parse some CVSS vector strings

Author: chadlwilsonCreated Aug 22, 2026Updated Aug 22, 2026

Labelsossindex

Describe the bug At time of writing OSSIndex/Guide results for this library cannot be parsed.


Failed to fetch component-report for: pkg:maven/org.springframework/[email protected]
java.lang.IllegalArgumentException: L
        at io.github.jeremylong.openvulnerability.client.nvd.ValueMappable.getOrThrow(ValueMappable.java:60)
        at io.github.jeremylong.openvulnerability.client.nvd.VectorMappable.lambda$create$1(VectorMappable.java:53)
        at io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data$CiaType.fromValue(CvssV2Data.java:631)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.transform(OssIndexAnalyzer.java:399)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.lambda$enrich$0(OssIndexAnalyzer.java:335)
        at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
        at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1716)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:570)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:560)
        at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:153)
        at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:176)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:265)
        at java.base/java.util.stream.ReferencePipeline.forEachOrdered(ReferencePipeline.java:637)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.enrich(OssIndexAnalyzer.java:336)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.analyzeDependency(OssIndexAnalyzer.java:204)
        at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)

Version of dependency-check used 13.0.0 via Gradle

To Reproduce Will attach better steps later, but scan a POm with the above dependency in it with OSSindex credentials set should be enough.

Expected behavior Vulns should be able to be parsed

Additional context The code seems to be falling back to a CVSS2 parse and then seeing an L for CIA type, which is invalid. Probably need to check the raw response and figure out if the data is bad, or the parsing is bad.

https://github.com/dependency-check/DependencyCheck/blob/02bb473c96a26353804d875f2bd39f35c9d96558/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java#L378-L396

Source: dependency-check/DependencyCheck

View original on GitHub View discussion on GitHub