Unable to query OSV for runtime dependency vulnerabilities

Error message

Unable to query OSV for runtime dependency vulnerabilities

What it means

DependenciesEndpoint.queryOsvBatch pages through OSV (osv.dev) batch vulnerability API responses for runtime dependencies. Any exception while querying OSV (network failure, HTTP error, bad response) is caught, this warning is logged, the exception message is added to the errors list, and scanning stops early. The endpoint still returns the dependencies scanned so far, but vulnerability data will be incomplete.

Solutions

Verify outbound HTTPS connectivity from the CAS server to api.osv.dev (curl https://api.osv.dev/v1/query) and fix proxy/firewall/DNS accordingly.
Configure JVM proxy settings (-Dhttps.proxyHost/-Dhttps.proxyPort) if egress requires a proxy.
Inspect the exception stack trace in the logs (logged alongside this warning) to distinguish DNS failure, timeout, or HTTP error, and address that root cause.
Retry after confirming OSV service status; the failure is transient if it is an upstream outage.

Example fix

// before: start CAS without egress
java -jar cas.war

// after: route through corporate proxy
java -Dhttps.proxyHost=proxy.corp.example -Dhttps.proxyPort=8080 -jar cas.war

Defensive patterns

Strategy: retry

Validate before calling

// preflight before invoking the endpoint
Process p = new ProcessBuilder("curl", "-sf", "https://api.osv.dev/v1/query", "-X", "POST").start();
boolean reachable = p.waitFor(5, TimeUnit.SECONDS) && p.exitValue() == 0;

Try / catch

try {
    queryOsvBatch(deps);
} catch (Exception e) {
    LOGGER.warn("OSV unavailable; retrying with backoff", e);
    retryWithBackoff(() -> queryOsvBatch(deps), 3);
}

Prevention

Verify egress/firewall rules for api.osv.dev before deploying CAS.
Configure JVM proxy properties in restricted networks.
Monitor OSV API status and expect transient failures during outages.

When it happens

Trigger: Calling the CAS dependencies/reports endpoint with OSV lookup enabled while the server has no outbound internet access, DNS resolution fails, osv.dev returns a non-success HTTP status or malformed response, or the request times out mid-pagination.

Common situations: CAS deployed in an air-gapped/DMZ network without egress to osv.dev; corporate proxy blocking api.osv.dev; OSV API outage or rate limiting; TLS trust store missing the OSV certificate in restricted environments.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/460dd7adaf2281c6. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-reports-core/src/main/java/org/apereo/cas/web/report/DependenciesEndpoint.java:148

                val response = HttpUtils.execute(exec);
                try {
                    val statusCode = HttpStatus.valueOf(response.getCode());
                    if (!statusCode.is2xxSuccessful()) {
                        errors.add("OSV querybatch request failed with status code " + statusCode);
                        return;
                    }

                    try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {
                        val responseBody = IOUtils.toString(content, StandardCharsets.UTF_8);
                        val osvResponse = MAPPER.readValue(responseBody, BatchResponse.class);
                        mapOsvResults(dependencies, osvResponse, vulnerabilities, errors);
                        pageToken = StringUtils.defaultString(osvResponse.nextPageToken());
                    }
                } finally {
                    HttpUtils.close(response);
                }
            } catch (final Exception e) {
                LOGGER.warn("Unable to query OSV for runtime dependency vulnerabilities", e);
                errors.add(e.getMessage());
                return;
            }
        } while (StringUtils.isNotBlank(pageToken));
    }

    private static Map<String, Object> buildOsvBatchRequest(final List<Dependency> dependencies,
                                                            final String pageToken) {
        val queries = dependencies
            .stream()
            .map(dependency -> Map.of(
                "version", dependency.version(),
                "package", Map.of("name", dependency.name(), "ecosystem", "Maven")))
            .toList();

        val request = new LinkedHashMap<String, Object>();
        request.put("queries", queries);
        if (StringUtils.isNotBlank(pageToken)) {

View on GitHub (pinned to e7288fc434)