DependencyTrack / DependencyTrack/dependency-track
False positive: CVE-2026-31789 (32-bit only) incorrectly reported on 64-bit component
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency-Track reports [CVE-2026-31789](https://nvd.nist.gov/vuln/detail/CVE-2026-31789) as affecting openssl. However, the vulnerability affects only 32-bit platforms, and my platform is 64-bit.
NIST excerpts:
> Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.
> As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity.
`uname -a` output:
```text
Linux 7c0f73d851f9 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 GNU/Linux
```
Excerpt from my Syft SBOM:
```json
{
"bom-ref": "pkg:deb/ubuntu/openssl@3.5.3-1ubuntu3.3?arch=amd64&distro=ubuntu-25.10&package-id=891189972c2807c0",
"type": "library",
"publisher": "Ubuntu Developers ",
"name": "openssl",
"version": "3.5.3-1ubuntu3.3",
...
"cpe": "cpe:2.3:a:openssl:openssl:3.5.3-1ubuntu3.3:*:*:*:*:*:*:*",
"purl": "pkg:deb/ubuntu/openssl@3.5.3-1ubuntu3.3?arch=amd64&distro=ubuntu-25.10",
```
Minimal offending SBOM: [minimal-openssl-sbom.json](https://github.com/user-attachments/files/27469630/minimal-openssl-sbom.json)
Dependency-Track screenshot 1:
Dependency-Track screenshot 2:
### Steps to Reproduce
1. Download the aforementioned minimal-openssl-sbom.json
2. Go to Dependency-Track and create a new project with dummy values, e.g. Project Name: dummy, Version: 0.0.1, Classifier: Application.
3. Go to Components -> Upload BOM -> Browse.
4. Select minimal-openssl-sbom.json
5. Wait until Dependency-Track populates the project with vulnerabilities.
6. Go to Audit Vulnerabilities. Observe that the table includes CVE-2026-31789:
### Expected Behavior
Dependency-Track should not report CVE-2026-31789.
### Dependency-Track Version
4.13.2
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.