{"record":{"id":"ed0c9ddc6fd3bc69","repo":"apereo/cas","slug":"unable-to-query-osv-vulnerability-details-for","errorCode":null,"errorMessage":"Unable to query OSV vulnerability details for [{}]","messagePattern":"Unable to query OSV vulnerability details for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-reports-core/src/main/java/org/apereo/cas/web/report/DependenciesEndpoint.java","lineNumber":212,"sourceCode":"        val exec = HttpExecutionRequest.builder()\n            .url(url)\n            .method(HttpMethod.GET)\n            .build();\n\n        val response = HttpUtils.execute(exec);\n        try {\n            val statusCode = HttpStatus.valueOf(response.getCode());\n            if (statusCode.is2xxSuccessful()) {\n                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {\n                    val responseBody = IOUtils.toString(content, StandardCharsets.UTF_8);\n                    val details = MAPPER.readValue(responseBody, VulnerabilityDetails.class);\n                    return new DependencyVulnerability(dependency, details);\n                }\n            } else {\n                errors.add(\"OSV vulnerability details request failed for \" + vulnerability.id() + \" with status code \" + statusCode);\n            }\n        } catch (final Exception e) {\n            LOGGER.warn(\"Unable to query OSV vulnerability details for [{}]\", vulnerability.id(), e);\n        } finally {\n            HttpUtils.close(response);\n        }\n        return null;\n    }\n\n    protected Set<Dependency> scanRuntimeDependencies() {\n        val dependencies = new LinkedHashSet<Dependency>();\n        scanClasspathEntries(dependencies);\n        scanClassLoaderUrls(dependencies);\n        return dependencies;\n    }\n\n    private static void scanClasspathEntries(final Set<Dependency> dependencies) {\n        val classpath = System.getProperty(\"java.class.path\", StringUtils.EMPTY);\n        if (StringUtils.isBlank(classpath)) {\n            return;\n        }","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-reports-core/src/main/java/org/apereo/cas/web/report/DependenciesEndpoint.java#L194-L230","documentation":"DependenciesEndpoint (actuator reports) queries the OSV.dev API for vulnerability details of each vulnerability id found in the dependency scan. When the details HTTP call fails (non-OK status) or throws (network error, timeout, JSON parsing), it logs this warning and returns null, so that dependency's vulnerability details are omitted from the report.","triggerScenarios":"getOsvVulnerabilityDetails performs an HTTP POST to OSV.dev for vulnerability.id(); any exception (IOException, connect/read timeout, unmarshal error) inside the try block is caught and logged as this warning.","commonSituations":"CAS server has no outbound internet access; OSV.dev rate limiting or temporary outage; proxy/firewall blocking HTTPS; DNS failures; OSV API returning an error status that surfaces as a parse exception downstream.","solutions":["Fix outbound connectivity to https://api.osv.dev (test with curl from the CAS host).","Configure proxy settings (https.proxyHost/-Dhttps.proxyHost etc.) if the environment requires a proxy.","Retry later if OSV.dev is rate-limiting or down; the report will regenerate on the next scan.","Check the attached exception in the log for the root cause (timeout vs DNS vs TLS)."],"exampleFix":"// before — no proxy, request fails\nLOGGER.warn(\"Unable to query OSV vulnerability details for [{}]\", vulnerability.id(), e);\n// after — configure proxy so the request succeeds\njava -Dhttps.proxyHost=proxy.corp -Dhttps.proxyPort=3128 -jar cas.war","handlingStrategy":"try-catch","validationCode":"curl -sS -o /dev/null -w '%{http_code}' https://api.osv.dev/v1/vulns/OSV-2020-1 || echo 'OSV unreachable'","typeGuard":null,"tryCatchPattern":"try {\n  report = endpoint.getOsvVulnerabilityDetails(vulnerability);\n} catch (Exception e) {\n  // report will be null; render the dependency without OSV details and continue\n}","preventionTips":["Verify outbound HTTPS access to api.osv.dev from the CAS host","Configure JVM proxy properties in restricted networks","Treat missing OSV details as degraded reporting, not a report failure","Watch OSV status pages during incidents"],"tags":["osv","vulnerability-scan","network","http"],"backgroundTag":"upstream-api-error","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}