[FP]: opentelemetry-js reported against JVM dependencies

[xcq1]

Package URl

pkg:maven/io.opentelemetry/opentelemetry-.*@1.62.0

CPE

cpe:2.3:a:opentelemetry:opentelemetry:1.62.0:::::::*

CVE

No response

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

13.0.0

Description

I am seeing CVE-2026-54285 with a CPE specifically for node.js which concerns something about the opentelemetry-js client being reported against 14 individual package URIs which are all JARs. Not sure if this can be solved at once or whether I'm really supposed to open 14 FP reports? I can say we already have the retirejs analyzer disabled.

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/33400669447

[xcq1]

I just realized it eports 3 more inapplicable CVEs:

• CVE-2026-40894 (.NET)
• CVE-2026-41178 (Go)
• CVE-2026-44967 (C++)

[chadlwilson]

Please look at the many related issues for opentelemetry linked to the below issue.