DependencyTrack / DependencyTrack/dependency-track

DefectDojo Integration Read time out error

Open
#5,391 3 comments 0 reactions 0 assignees View on GitHub
defect integration/defectdojo pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, when the DefectDojo Integration does a sync, it fails with a `SocketTimeoutExection: Read timed out`

Relevant Log output (on TRACE level):

```log
2025-10-09 10:02:49,766 DEBUG [EventService] Dispatching event: class org.dependencytrack.event.DefectDojoUploadEventAbstract
2025-10-09 10:02:49,766 DEBUG [EventService] Alerting subscriber org.dependencytrack.tasks.DefectDojoUploadTask
2025-10-09 10:02:49,766 DEBUG [SingleThreadedEventService] Dispatching event: class org.dependencytrack.event.DefectDojoUploadEventAbstract
2025-10-09 10:02:49,766 DEBUG [SingleThreadedEventService] No subscribers to inform from event: org.dependencytrack.event.DefectDojoUploadEventAbstract
2025-10-09 10:02:49,766 DEBUG [DefectDojoUploadTask] Starting DefectDojo upload task
2025-10-09 10:02:49,804 DEBUG [VulnerabilityManagementUploadTask] Initializing integration point: DefectDojo [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:02:50,722 DEBUG [VulnerabilityManagementUploadTask] Uploading findings to DefectDojo [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:02:50,728 DEBUG [DefectDojoClient] Pulling DefectDojo Tests API ... [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:02:50,728 DEBUG [DefectDojoClient] Make the first pagination call [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:02:50,792 DEBUG [DefectDojoClient] Successfully retrieved the test list [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:02:50,794 DEBUG [DefectDojoUploader] Found existing test Id: 27 [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:02:50,796 DEBUG [DefectDojoClient] Re-reimport Dependency-Track findings to DefectDojo per Engagement [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:03:20,885 ERROR [DefectDojoClient] An error occurred with the DefectDojo integration point [projectName=, projectUuid=, projectVersion=]
java.net.SocketTimeoutException: Read timed out
at java.base/sun.nio.ch.NioSocketImpl.timedRead(Unknown Source)
at java.base/sun.nio.ch.NioSocketImpl.implRead(Unknown Source)
at java.base/sun.nio.ch.NioSocketImpl.read(Unknown Source)
at java.base/sun.nio.ch.NioSocketImpl$1.read(Unknown Source)
at java.base/java.net.Socket$SocketInputStream.read(Unknown Source)
at org.apache.http.impl.io.SessionInputBufferImpl.streamRead(SessionInputBufferImpl.java:137)
at org.apache.http.impl.io.SessionInputBufferImpl.fillBuffer(SessionInputBufferImpl.java:153)
at org.apache.http.impl.io.SessionInputBufferImpl.readLine(SessionInputBufferImpl.java:280)
at org.apache.http.impl.conn.DefaultHttpResponseParser.parseHead(DefaultHttpResponseParser.java:138)
at org.apache.http.impl.conn.DefaultHttpResponseParser.parseHead(DefaultHttpResponseParser.java:56)
at org.apache.http.impl.io.AbstractMessageParser.parse(AbstractMessageParser.java:259)
at org.apache.http.impl.DefaultBHttpClientConnection.receiveResponseHeader(DefaultBHttpClientConnection.java:163)
at org.apache.http.impl.conn.CPoolProxy.receiveResponseHeader(CPoolProxy.java:157)
at org.apache.http.protocol.HttpRequestExecutor.doReceiveResponse(HttpRequestExecutor.java:273)
at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:125)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:272)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.dependencytrack.integrations.defectdojo.DefectDojoClient.reimportDependencyTrackFindings(DefectDojoClient.java:191)
at org.dependencytrack.integrations.defectdojo.DefectDojoUploader.upload(DefectDojoUploader.java:131)
at org.dependencytrack.tasks.VulnerabilityManagementUploadTask.processProjectFindings(VulnerabilityManagementUploadTask.java:102)
at org.dependencytrack.tasks.VulnerabilityManagementUploadTask.processProjects(VulnerabilityManagementUploadTask.java:83)
at org.dependencytrack.tasks.VulnerabilityManagementUploadTask.inform(VulnerabilityManagementUploadTask.java:60)
at org.dependencytrack.tasks.DefectDojoUploadTask.inform(DefectDojoUploadTask.java:37)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
2025-10-09 10:03:20,885 DEBUG [NotificationService] Dispatching notification: class alpine.notification.Notification [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:03:20,885 DEBUG [NotificationService] Alerting subscriber org.dependencytrack.notification.NotificationRouter [projectName=, projectUuid=, projectVersion=]
2025-10-09 10:03:20,913 DEBUG [DefectDojoUploadTask] DefectDojo upload complete
2025-10-09 10:03:21,034 DEBUG [NotificationRouter] Matched 0 notification rules (PublishContext{notificationGroup=INTEGRATION, notificationLevel=ERROR, notificationScope=SYSTEM, notificationTimestamp=2025-10-09T10:03:20.885434219Z, notificationSubjects={}})
```

### Steps to Reproduce

1. Create a Project in DTrack with a lot of findings (in our example that crashes we have 2200 findings)
2. Setup DefectDojo integration as described in the documentation with reimport and doNotReactivate options turned on
3. Wait for sync
4. See error in logs of DTrack

### Expected Behavior

The Integration should be able to sync without error.

### Dependency-Track Version

4.13.4

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.