dependency-check / dependency-check/DependencyCheck
Dependency vulnerability scan does not report CVE-2026-40973, but reports newer CVE-2026-4258
Open
enhancement
nvd
question
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
Hello support team,
We are using Dependency Check to scan vulnerable dependencies in our Java components.
We noticed an inconsistency in scan results:
- CVE-2026-40973 is not reported in the scan output
- CVE-2026-42581 is reported
- CVE-2026-40982 is reported
- CVE-2026-41002 is reported
We also checked suppressed vulnerabilities but could not find CVE-2026-40973 anywhere
However, this CVE-2026-40973 is reported when using Sonatype scan
Could you help to guide how to investigate to find out the root cause why CVE-2026-40973 is not reported with Dependency Check tool?
Contributor guide
Assessment
This issue has not been assessed yet.