Dependency vulnerability scan does not report CVE-2026-40973, but reports newer CVE-2026-4258

[dangkhoaphung]

Hello support team,

We are using Dependency Check to scan vulnerable dependencies in our Java components.

We noticed an inconsistency in scan results:

• CVE-2026-40973 is not reported in the scan output
• CVE-2026-42581 is reported
• CVE-2026-40982 is reported
• CVE-2026-41002 is reported

We also checked suppressed vulnerabilities but could not find CVE-2026-40973 anywhere
However, this CVE-2026-40973 is reported when using Sonatype scan

Could you help to guide how to investigate to find out the root cause why CVE-2026-40973 is not reported with Dependency Check tool?

[chadlwilson]

You’d need to supply an HTML or JSON report from your scan, or an example project with set of steps that allow someone else to replicate your results. ODC uses heuristics to match, so the exact inputs and outputs are important.

[dangkhoaphung]

Hi @chadlwilson , please help to check this HTML report
dependency-check-report.html

[chadlwilson]

It looks like you are scanning an uber-jar, or a jar containing other jars - possibly the built Spring Boot uber-jar. This is always going to have a higher false negative & false positive rate with ODC, since the Maven/Gradle metadata group:artifact:version is not available to use.

The problem is that the Spring Boot jars are not being matched to package identifiers with high quality metadata.

Since you're not scanning with the Maven or Gradle ODC plugin, ODC needs to rely on file names, and looking inside the jars for metadata, primarily in pom.xml files or META-INF/MANIFEST.MF. This is made worse for Spring Boot because they are a Gradle project - gradle-built jars do not contain a pom.xml file, and thus no high-quality source of metadata. Your scan is primarily relying on manifest metadata which is usually poor quality for matching.

ODC sees spring-boot-3.4.13-dependency-check-sample-0.0.1-SNAPSHOT.jar: spring-boot-3.4.13.jar and this evidence:

The issue is that within the (American) NVD (ODC's primary source of vulns for Java artifacts), Spring Boot vulns are under cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*. Since there is no reference to vmware anywhere inside the Vendor evidence, ODC fails to match it. It has no way to know that the jar being scanned (or the similar jars) are the same thing as vmware:spring_boot

There are some special hints to make this work for spring-core, but none for Spring Boot. We should probably add some - but scanning in this way is always going to be at high risk of both false positives and false negatives.

Even without us changing anything in ODC, you will get better results if you

• consider scanning using the Maven or Gradle plugins, not the CLI or Docker image
• alternatively, ensure your Maven Central search is enabled and working (centralEnabled) so ODC can search online to find the Maven package co-ordinates
• consider signing up for and configuring the Sonatype Guide (aka OSSIndex) analyzer. Unfortunately its free limits are very limited now, but if you have Sonatype licenses already perhaps you have ability to get API keys with reasonable limits.

You can also add your own hints file (check the CLI docs for --hints, something like this will probably work):

https://dependency-check.github.io/DependencyCheck/general/hints.html

<?xml version="1.0" encoding="UTF-8"?>
<hints xmlns="https://jeremylong.github.io/DependencyCheck/dependency-hint.1.4.xsd"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="https://jeremylong.github.io/DependencyCheck/dependency-hint.1.4.xsd
                           https://dependency-check.github.io/DependencyCheck/dependency-hint.1.4.xsd">
    <hint>
        <given>
            <evidence regex="true" type="product" source="Manifest" name="Implementation-Title" value="Spring Boot.*" confidence="HIGH"/>
        </given>
        <add>
            <evidence type="vendor" source="hint analyzer" name="vendor" value="vmware" confidence="HIGHEST"/>
            <evidence type="product" source="hint analyzer" name="product" value="spring_boot" confidence="HIGHEST"/>
        </add>
    </hint>
</hints>

[dangkhoaphung]

Thank for your support