{"record":{"id":"460dd7adaf2281c6","repo":"apereo/cas","slug":"unable-to-query-osv-for-runtime-dependency-vulnera","errorCode":null,"errorMessage":"Unable to query OSV for runtime dependency vulnerabilities","messagePattern":"Unable to query OSV for runtime dependency vulnerabilities","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-reports-core/src/main/java/org/apereo/cas/web/report/DependenciesEndpoint.java","lineNumber":148,"sourceCode":"                val response = HttpUtils.execute(exec);\n                try {\n                    val statusCode = HttpStatus.valueOf(response.getCode());\n                    if (!statusCode.is2xxSuccessful()) {\n                        errors.add(\"OSV querybatch request failed with status code \" + statusCode);\n                        return;\n                    }\n\n                    try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {\n                        val responseBody = IOUtils.toString(content, StandardCharsets.UTF_8);\n                        val osvResponse = MAPPER.readValue(responseBody, BatchResponse.class);\n                        mapOsvResults(dependencies, osvResponse, vulnerabilities, errors);\n                        pageToken = StringUtils.defaultString(osvResponse.nextPageToken());\n                    }\n                } finally {\n                    HttpUtils.close(response);\n                }\n            } catch (final Exception e) {\n                LOGGER.warn(\"Unable to query OSV for runtime dependency vulnerabilities\", e);\n                errors.add(e.getMessage());\n                return;\n            }\n        } while (StringUtils.isNotBlank(pageToken));\n    }\n\n    private static Map<String, Object> buildOsvBatchRequest(final List<Dependency> dependencies,\n                                                            final String pageToken) {\n        val queries = dependencies\n            .stream()\n            .map(dependency -> Map.of(\n                \"version\", dependency.version(),\n                \"package\", Map.of(\"name\", dependency.name(), \"ecosystem\", \"Maven\")))\n            .toList();\n\n        val request = new LinkedHashMap<String, Object>();\n        request.put(\"queries\", queries);\n        if (StringUtils.isNotBlank(pageToken)) {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-reports-core/src/main/java/org/apereo/cas/web/report/DependenciesEndpoint.java#L130-L166","documentation":"DependenciesEndpoint.queryOsvBatch pages through OSV (osv.dev) batch vulnerability API responses for runtime dependencies. Any exception while querying OSV (network failure, HTTP error, bad response) is caught, this warning is logged, the exception message is added to the errors list, and scanning stops early. The endpoint still returns the dependencies scanned so far, but vulnerability data will be incomplete.","triggerScenarios":"Calling the CAS dependencies/reports endpoint with OSV lookup enabled while the server has no outbound internet access, DNS resolution fails, osv.dev returns a non-success HTTP status or malformed response, or the request times out mid-pagination.","commonSituations":"CAS deployed in an air-gapped/DMZ network without egress to osv.dev; corporate proxy blocking api.osv.dev; OSV API outage or rate limiting; TLS trust store missing the OSV certificate in restricted environments.","solutions":["Verify outbound HTTPS connectivity from the CAS server to api.osv.dev (curl https://api.osv.dev/v1/query) and fix proxy/firewall/DNS accordingly.","Configure JVM proxy settings (-Dhttps.proxyHost/-Dhttps.proxyPort) if egress requires a proxy.","Inspect the exception stack trace in the logs (logged alongside this warning) to distinguish DNS failure, timeout, or HTTP error, and address that root cause.","Retry after confirming OSV service status; the failure is transient if it is an upstream outage."],"exampleFix":"// before: start CAS without egress\njava -jar cas.war\n\n// after: route through corporate proxy\njava -Dhttps.proxyHost=proxy.corp.example -Dhttps.proxyPort=8080 -jar cas.war","handlingStrategy":"retry","validationCode":"// preflight before invoking the endpoint\nProcess p = new ProcessBuilder(\"curl\", \"-sf\", \"https://api.osv.dev/v1/query\", \"-X\", \"POST\").start();\nboolean reachable = p.waitFor(5, TimeUnit.SECONDS) && p.exitValue() == 0;","typeGuard":null,"tryCatchPattern":"try {\n    queryOsvBatch(deps);\n} catch (Exception e) {\n    LOGGER.warn(\"OSV unavailable; retrying with backoff\", e);\n    retryWithBackoff(() -> queryOsvBatch(deps), 3);\n}","preventionTips":["Verify egress/firewall rules for api.osv.dev before deploying CAS.","Configure JVM proxy properties in restricted networks.","Monitor OSV API status and expect transient failures during outages."],"tags":["network","osv","vulnerability-scan","http"],"backgroundTag":"network-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}