[FP]: CVE-2026-47842 reported against fixed version 7.1.1

[xcq1]

Package URl

pkg:maven/org.springframework.security/spring-security-crypto@7.1.1

CPE

cpe:2.3:a:pivotal_software:spring_security:7.1.1

CVE

CVE-2026-47842

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

13.0.0

Description

I'm seeing CVE-2026-47842 which according to NIST, Sonatype, and Spring should only apply to <=7.1.0 and 7.1.1 being a recommended fix version.

[github-actions]

Maven Coordinates

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-crypto</artifactId>
  <version>7.1.1</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8776
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring-security-crypto@.*$</packageUrl>
    <cpe regex="true">cpe:/a:pivotal_software:spring_security(:.*)?$</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/33402018361

[chadlwilson]

Can't reproduce this, sorry, looks fine here. Maybe data was fixed /changed upstream and you have a stale cache.

Will re-open if you can supply a report with the evidence section (html, xml, or JSON), which is what we'd need to confirm or investigate further.

[xcq1]

Ah sorry, just figured out that the CVE disappears when I remove ossIndex credentials, so I guess I'll check Sonatype again.

[chadlwilson]

Yeah, at time of writing I now see they are marking 7.1.1 as still vulnerable.

https://guide.sonatype.com/component/maven/org.springframework.security%3Aspring-security-crypto/7.1.1/vulnerabilities

Likely due to the deviation notice at https://guide.sonatype.com/vulnerability/CVE-2026-47842/sonatype-research

It should be obvious from the report that it is coming from OSSIndex without you having to play around with config. It is explicitly marked as such if OSSINDEX is the only source. If it is also in the NVD it should still have all the links/evidence from OSSIndex/Sonatype Guide attached.