DependencyTrack / DependencyTrack/dependency-track

False positive: CVE-2026-31789 (32-bit only) incorrectly reported on 64-bit component

Open
#6,115 2 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency-Track reports [CVE-2026-31789](https://nvd.nist.gov/vuln/detail/CVE-2026-31789) as affecting openssl. However, the vulnerability affects only 32-bit platforms, and my platform is 64-bit.

NIST excerpts:

> Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms.

> As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity.

`uname -a` output:

```text
Linux 7c0f73d851f9 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 GNU/Linux
```

Excerpt from my Syft SBOM:

```json
{
"bom-ref": "pkg:deb/ubuntu/openssl@3.5.3-1ubuntu3.3?arch=amd64&distro=ubuntu-25.10&package-id=891189972c2807c0",
"type": "library",
"publisher": "Ubuntu Developers ",
"name": "openssl",
"version": "3.5.3-1ubuntu3.3",
...
"cpe": "cpe:2.3:a:openssl:openssl:3.5.3-1ubuntu3.3:*:*:*:*:*:*:*",
"purl": "pkg:deb/ubuntu/openssl@3.5.3-1ubuntu3.3?arch=amd64&distro=ubuntu-25.10",
```

Minimal offending SBOM: [minimal-openssl-sbom.json](https://github.com/user-attachments/files/27469630/minimal-openssl-sbom.json)

Dependency-Track screenshot 1:

Image

Dependency-Track screenshot 2:

Image

### Steps to Reproduce

1. Download the aforementioned minimal-openssl-sbom.json
2. Go to Dependency-Track and create a new project with dummy values, e.g. Project Name: dummy, Version: 0.0.1, Classifier: Application.
3. Go to Components -> Upload BOM -> Browse.
4. Select minimal-openssl-sbom.json
5. Wait until Dependency-Track populates the project with vulnerabilities.
6. Go to Audit Vulnerabilities. Observe that the table includes CVE-2026-31789:

Image

### Expected Behavior

Dependency-Track should not report CVE-2026-31789.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.