apereo/cas · warning

Unable to query OSV vulnerability details for

Error message

Unable to query OSV vulnerability details for [{}]

What it means

DependenciesEndpoint (actuator reports) queries the OSV.dev API for vulnerability details of each vulnerability id found in the dependency scan. When the details HTTP call fails (non-OK status) or throws (network error, timeout, JSON parsing), it logs this warning and returns null, so that dependency's vulnerability details are omitted from the report.

Solutions

1. Fix outbound connectivity to https://api.osv.dev (test with curl from the CAS host).
2. Configure proxy settings (https.proxyHost/-Dhttps.proxyHost etc.) if the environment requires a proxy.
3. Retry later if OSV.dev is rate-limiting or down; the report will regenerate on the next scan.
4. Check the attached exception in the log for the root cause (timeout vs DNS vs TLS).

Example fix

// before — no proxy, request fails
LOGGER.warn("Unable to query OSV vulnerability details for [{}]", vulnerability.id(), e);
// after — configure proxy so the request succeeds
java -Dhttps.proxyHost=proxy.corp -Dhttps.proxyPort=3128 -jar cas.war

curl -sS -o /dev/null -w '%{http_code}' https://api.osv.dev/v1/vulns/OSV-2020-1 || echo 'OSV unreachable'

try {
  report = endpoint.getOsvVulnerabilityDetails(vulnerability);
} catch (Exception e) {
  // report will be null; render the dependency without OSV details and continue
}

When it happens

Trigger: getOsvVulnerabilityDetails performs an HTTP POST to OSV.dev for vulnerability.id(); any exception (IOException, connect/read timeout, unmarshal error) inside the try block is caught and logged as this warning.

Common situations: CAS server has no outbound internet access; OSV.dev rate limiting or temporary outage; proxy/firewall blocking HTTPS; DNS failures; OSV API returning an error status that surfaces as a parse exception downstream.

Related errors

• Unable to query OSV for runtime dependency vulnerabilities
• Unable to get entity from MDQ server and a backup file does…
• Failed to save google authenticator account
• Unable to successfully fetch JWKS resource from
• No (successful) logout response received from the url

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/ed0c9ddc6fd3bc69. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-reports-core/src/main/java/org/apereo/cas/web/report/DependenciesEndpoint.java:212

        val exec = HttpExecutionRequest.builder()
            .url(url)
            .method(HttpMethod.GET)
            .build();

        val response = HttpUtils.execute(exec);
        try {
            val statusCode = HttpStatus.valueOf(response.getCode());
            if (statusCode.is2xxSuccessful()) {
                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {
                    val responseBody = IOUtils.toString(content, StandardCharsets.UTF_8);
                    val details = MAPPER.readValue(responseBody, VulnerabilityDetails.class);
                    return new DependencyVulnerability(dependency, details);
                }
            } else {
                errors.add("OSV vulnerability details request failed for " + vulnerability.id() + " with status code " + statusCode);
            }
        } catch (final Exception e) {
            LOGGER.warn("Unable to query OSV vulnerability details for [{}]", vulnerability.id(), e);
        } finally {
            HttpUtils.close(response);
        }
        return null;
    }

    protected Set<Dependency> scanRuntimeDependencies() {
        val dependencies = new LinkedHashSet<Dependency>();
        scanClasspathEntries(dependencies);
        scanClassLoaderUrls(dependencies);
        return dependencies;
    }

    private static void scanClasspathEntries(final Set<Dependency> dependencies) {
        val classpath = System.getProperty("java.class.path", StringUtils.EMPTY);
        if (StringUtils.isBlank(classpath)) {
            return;
        }

View on GitHub (pinned to e7288fc434)