[FP]: CVE-2026-42154 matched against Micrometer instead of Prometheus

[marcelstoer]

Package URl

pkg:maven/io.micrometer/micrometer-registry-prometheus@1.15.11

CPE

cpe:2.3:a:prometheus:prometheus:1.15.11:::::::*

CVE

CVE-2026-42154

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.2.1

Description

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/25720939841

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/25720952225

[github-actions]

Maven Coordinates

<dependency>
  <groupId>io.micrometer</groupId>
  <artifactId>micrometer-registry-prometheus</artifactId>
  <version>1.15.11</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8497
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/io\.micrometer/micrometer-registry-prometheus@.*$</packageUrl>
    <cpe>cpe:/a:prometheus:prometheus</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/25721023699

[chadlwilson]

Approved

We probably need to consolidate suppressions here as there are dozens of these, but will add this for now.

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[marcelstoer]

dozens of these

Which ones do you refer to? We currently have 7 for cpe:/a:prometheus:prometheus.

[chadlwilson]

There are a whole lot across base suppressions and hosted suppressions, incl some for individual CVEs. And there are many more Maven libraries that are likely incorrectly matching - just not appearing as FPs just yet due to luck.

Can't recall if I've done so already, but with some research into whether prometheus:prometheus is only ever used for the server component - the CPE could possibly be suppressed across all non-golang ecosystems. It's possible it's indeterminate though, as is often the case when the main artifact is the server and peripheral language artifacts are clients or API types.

[chadlwilson]

Based on https://nvd.nist.gov/vuln/search#/nvd/home?cpeFilterMode=applicability&cpeName=cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*&resultType=records the CVEs are only for the server it's probably safe to do something more generic; noting that CVEs like https://nvd.nist.gov/vuln/detail/CVE-2022-21698 have their own CPE.