Add CVSSv4 support by nscuro · Pull Request #5863 · DependencyTrack/dependency-track

nscuro · 2026-03-03T14:30:30Z

Description

Adds CVSSv4 support.

Credit to @tobiasgies for doing the grunt of this work in #5456.

Addressed Issue

Closes #4707
Frontend PR: DependencyTrack/frontend#1455

Additional Details

Supersedes #5456

Differs from the previous PR in a few ways:

Does not track multiple scores (base, threat, environmental). CVSSv4 does not have the concept of subscores anymore, so we only track one unified score.
Omits the manual ALTER TABLE statements to add new columns; The ORM takes care of adding new columns automatically.
Does not deprecate old VulnerabilityUtil#getSeverity methods. Instead update all call sites to use the new method signature. We're the only consumers of these methods, no need to keep things backward-compatible.
Adds an UpgradeItem to reset the watermarks for vulnerability sources that use incremental mirroring. Necessary to enable backfill of CVSSv4 data.

Checklist

I have read and understand the contributing guidelines
~~This PR fixes a defect, and I have provided tests to verify that the fix is effective~~
This PR implements an enhancement, and I have provided tests to verify that it works as intended
~~This PR introduces changes to the database model, and I have added corresponding update logic~~
~~This PR introduces new or alters existing behavior, and I have updated the documentation accordingly~~

owasp-dt-bot · 2026-03-03T14:30:45Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Copilot

Pull request overview

Adds backend support for ingesting, persisting, exposing, and querying CVSS v4 scores/vectors across multiple vulnerability sources (NVD API/feed, GitHub advisories, Trivy, OSV, OSS Index), and updates severity calculation to prefer CVSSv4 when present.

Changes:

Extend the data model and persistence/query layers to store CVSSv4 score/vector and support filtering/sorting by CVSSv4.
Update parsers/mirroring/scanners to populate CVSSv4 fields and prefer v4 for severity where applicable.
Add/extend unit and resource tests + fixtures to validate CVSSv4 ingestion and API responses.

Reviewed changes

Copilot reviewed 39 out of 39 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/test/resources/unit/osv.jsons/osv-GHSA-q2x7-8rv6-6q7h.json	Adds OSV fixture containing CVSSv4 + CVSSv3 severity entries.
src/test/resources/unit/nvd/feed/nvdcve-2.0-2022.json	Extends NVD feed fixture with `cvssMetricV40` sample.
src/test/resources/unit/nvd/api/jsons/cve-2025-9377.json	Adds NVD API v2.0 response fixture including CVSSv4 metrics.
src/test/java/org/dependencytrack/util/VulnerabilityUtilTest.java	Adds CVSSv4 severity normalization + updated `getSeverity` tests.
src/test/java/org/dependencytrack/tasks/scanners/TrivyAnalysisTaskTest.java	Verifies CVSSv4 vector/score mapping from Trivy protobufs.
src/test/java/org/dependencytrack/tasks/scanners/OssIndexAnalysisTaskTest.java	Adds OSS Index CVSSv4 ingestion test coverage.
src/test/java/org/dependencytrack/tasks/OsvDownloadTaskTest.java	Adds OSV severity calculation + mapping tests for CVSSv4.
src/test/java/org/dependencytrack/tasks/NistMirrorTaskTest.java	Asserts NVD feed mirroring maps CVSSv4 and affects severity.
src/test/java/org/dependencytrack/tasks/NistApiMirrorTaskTest.java	Adds NVD API mirroring test for CVSSv4 ingestion.
src/test/java/org/dependencytrack/tasks/GitHubAdvisoryMirrorTaskTest.java	Adds GitHub advisory CVSSv4 handling test coverage.
src/test/java/org/dependencytrack/resources/v1/VulnerabilityResourceTest.java	Ensures REST create/update includes CVSSv4 vector/score and updated severity.
src/test/java/org/dependencytrack/resources/v1/CalculatorResourceTest.java	Adds `/v1/calculator/cvss` test for CVSSv4 vectors.
src/test/java/org/dependencytrack/parser/osv/OsvAdvisoryParserTest.java	Adds OSV advisory parsing test for CVSSv4 severity entries.
src/test/java/org/dependencytrack/notification/publisher/WebhookPublisherTest.java	Updates webhook payload assertions to include `cvssv4`.
src/test/java/org/dependencytrack/notification/publisher/AbstractPublisherTest.java	Adds CVSSv4 score to shared vulnerability test builder.
src/test/java/org/dependencytrack/model/VulnerabilityTest.java	Adds CVSSv4 vector/score field tests and severity expectations.
src/test/java/org/dependencytrack/model/GroupedFindingTest.java	Updates grouped finding mapping to include CVSSv4 score.
src/test/java/org/dependencytrack/model/FindingTest.java	Updates finding mapping to include CVSSv4 score.
src/test/java/org/dependencytrack/integrations/FindingPackagingFormatTest.java	Updates Finding construction for new CVSSv4 parameter.
src/main/java/org/dependencytrack/util/VulnerabilityUtil.java	Extends severity calculation/normalization utilities to accept CVSSv4.
src/main/java/org/dependencytrack/util/NotificationUtil.java	Includes CVSSv4 score in notification vulnerability JSON.
src/main/java/org/dependencytrack/upgrade/v4110/v4110Updater.java	Updates severity recomputation call to new `getSeverity` signature.
src/main/java/org/dependencytrack/tasks/scanners/OssIndexAnalysisTask.java	Parses CVSSv4 vectors and applies v4 scores when present.
src/main/java/org/dependencytrack/tasks/OsvDownloadTask.java	Maps OSV CVSSv4 vector + uses it for severity derivation.
src/main/java/org/dependencytrack/resources/v1/VulnerabilityResource.java	Validates CVSSv4 vector + recalculates v4 score from vector.
src/main/java/org/dependencytrack/resources/v1/FindingResource.java	Adds CVSSv4 range filters to findings endpoints.
src/main/java/org/dependencytrack/resources/v1/CalculatorResource.java	Updates API docs/messages to accept CVSSv4 vectors.
src/main/java/org/dependencytrack/persistence/VulnerabilityQueryManager.java	Persists CVSSv4 vector/score changes via diffing.
src/main/java/org/dependencytrack/persistence/FindingsSearchQueryManager.java	Adds CVSSv4 sorting/filtering + fixes result index offsets.
src/main/java/org/dependencytrack/parser/vulndb/ModelConverter.java	Updates severity calculation call to include CVSSv4 score.
src/main/java/org/dependencytrack/parser/trivy/TrivyParser.java	Maps Trivy v4 vector/score into Vulnerability fields.
src/main/java/org/dependencytrack/parser/osv/model/OsvAdvisory.java	Adds CVSSv4 vector field to OSV advisory model.
src/main/java/org/dependencytrack/parser/osv/OsvAdvisoryParser.java	Extracts CVSSv4 vector from OSV `severity[]`.
src/main/java/org/dependencytrack/parser/nvd/api20/ModelConverter.java	Ingests NVD API CVSSv4 metrics and persists score/vector.
src/main/java/org/dependencytrack/parser/github/ModelConverter.java	Applies CVSSv4 score/vector from GitHub advisory payloads.
src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java	Emits CycloneDX CVSSv4 ratings and shares CVSS3/4 severity mapping.
src/main/java/org/dependencytrack/model/Vulnerability.java	Adds CVSSv4 DB columns + getters/setters + `applyV4Score`.
src/main/java/org/dependencytrack/model/GroupedFinding.java	Adds CVSSv4 score to grouped findings query + mapping.
src/main/java/org/dependencytrack/model/Finding.java	Adds CVSSv4 score to findings queries + mapping/severity derivation.

Comments suppressed due to low confidence (1)

src/main/java/org/dependencytrack/resources/v1/CalculatorResource.java:83

Now that this endpoint accepts CVSSv4 vectors, cvss.getBakedScores() can yield NaN for fields that are not defined for v4 (impact/exploitability/temporal/environmental). Those double values will serialize as the string "NaN" (to keep JSON valid), which breaks the declared numeric schema and can surprise API consumers. Consider switching the Score record fields to boxed Double and mapping NaN to null (or omitting those fields) when the underlying score is not applicable.

    public Response getCvssScores(
            @Parameter(description = "A valid CVSSv2, CVSSv3, or CVSSv4 vector", required = true)
            @QueryParam("vector") String vector) {
        final String invalidVector = "An invalid CVSSv2, CVSSv3, or CVSSv4 vector submitted.";

        final var cvss = CvssUtil.parse(vector);
        if (cvss == null) {
            return Response.status(Response.Status.BAD_REQUEST).entity(invalidVector).build();
        }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/main/java/org/dependencytrack/util/VulnerabilityUtil.java

src/main/java/org/dependencytrack/tasks/OsvDownloadTask.java

Copilot

Pull request overview

Copilot reviewed 41 out of 41 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/main/java/org/dependencytrack/resources/v1/CalculatorResource.java:82

CalculatorResource now accepts CVSSv4 vectors, but for CVSSv4 the baked sub-scores (impact/exploitability/temporal/environmental/modifiedImpact) can be NaN, which ends up serialized as the string "NaN" (see CalculatorResourceTest). This produces mixed JSON types (number vs string) and is hard for API clients to consume. Consider changing the response model to use boxed Doubles and convert NaN -> null (or omit unsupported fields) so the JSON remains type-stable and valid for all vectors.

    public Response getCvssScores(
            @Parameter(description = "A valid CVSSv2, CVSSv3, or CVSSv4 vector", required = true)
            @QueryParam("vector") String vector) {
        final String invalidVector = "An invalid CVSSv2, CVSSv3, or CVSSv4 vector submitted.";

        final var cvss = CvssUtil.parse(vector);
        if (cvss == null) {
            return Response.status(Response.Status.BAD_REQUEST).entity(invalidVector).build();

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/main/java/org/dependencytrack/parser/nvd/api20/ModelConverter.java

src/main/java/org/dependencytrack/tasks/OsvDownloadTask.java

src/main/java/org/dependencytrack/upgrade/UpgradeItems.java

codacy-production · 2026-03-03T14:59:39Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.09% (target: -1.00%)	✅ 80.45% (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`0be31b6`)	24666	20056	81.31%
Head commit (`70bf63f`)	24745 (+79)	20143 (+87)	81.40% (+0.09%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#5863)	133	107	80.45%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

Co-authored-by: Tobias Gies <[email protected]> Signed-off-by: nscuro <[email protected]>

Copilot

Pull request overview

Copilot reviewed 41 out of 41 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/main/java/org/dependencytrack/resources/v1/CalculatorResource.java

nscuro added this to the 4.14.0 milestone Mar 3, 2026

Copilot AI review requested due to automatic review settings March 3, 2026 14:30

nscuro added the enhancement New feature or request label Mar 3, 2026

Copilot started reviewing on behalf of nscuro March 3, 2026 14:31 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

src/main/java/org/dependencytrack/util/VulnerabilityUtil.java Show resolved Hide resolved

src/main/java/org/dependencytrack/tasks/OsvDownloadTask.java Outdated Show resolved Hide resolved

nscuro force-pushed the cvssv4 branch from e309d26 to c0b1681 Compare March 3, 2026 14:50

nscuro requested a review from Copilot March 3, 2026 14:50

Copilot started reviewing on behalf of nscuro March 3, 2026 14:50 View session

nscuro mentioned this pull request Mar 3, 2026

Add CVSSv4 support DependencyTrack/frontend#1455

Merged

1 task

Copilot AI reviewed Mar 3, 2026

View reviewed changes

src/main/java/org/dependencytrack/parser/nvd/api20/ModelConverter.java Outdated Show resolved Hide resolved

src/main/java/org/dependencytrack/tasks/OsvDownloadTask.java Show resolved Hide resolved

src/main/java/org/dependencytrack/upgrade/UpgradeItems.java Show resolved Hide resolved

Add CVSSv4 support

70bf63f

Co-authored-by: Tobias Gies <[email protected]> Signed-off-by: nscuro <[email protected]>

nscuro force-pushed the cvssv4 branch from c0b1681 to 70bf63f Compare March 3, 2026 15:05

nscuro requested a review from Copilot March 3, 2026 15:05

Copilot started reviewing on behalf of nscuro March 3, 2026 15:05 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

src/main/java/org/dependencytrack/resources/v1/CalculatorResource.java Show resolved Hide resolved

nscuro merged commit 333ec11 into DependencyTrack:master Mar 3, 2026
14 checks passed

nscuro deleted the cvssv4 branch March 3, 2026 15:39

nscuro mentioned this pull request Mar 3, 2026

Add CVSSv4 support to Dependency-Track #5456

Closed

5 tasks

nscuro mentioned this pull request Mar 19, 2026

Port changes from DependencyTrack v4.14.0 DependencyTrack/hyades#2105

Open

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add CVSSv4 support#5863

Add CVSSv4 support#5863
nscuro merged 1 commit intoDependencyTrack:masterfrom
nscuro:cvssv4

nscuro commented Mar 3, 2026 •

edited

Loading

Uh oh!

owasp-dt-bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codacy-production bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

nscuro commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Addressed Issue

Additional Details

Checklist

Uh oh!

owasp-dt-bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codacy-production bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nscuro commented Mar 3, 2026 •

edited

Loading

owasp-dt-bot commented Mar 3, 2026 •

edited

Loading

codacy-production bot commented Mar 3, 2026 •

edited

Loading