Trigging Vulnerability Analysis on a specific project

[itmanju]

Current Behavior

We are trying to Triger Vulnerability Analysis on a specific project using Ui and Api cal
But the vulnerabilities are same as before.

But if we re upload the same SBOM it removes old vulnerabilities which are not associated with the components

Steps to Reproduce

1.Enabled Enable fuzzy CPE matching. for internal analyser.
2.upload a project
3. you will find lot of vulnerabilties which are not even associated with components present.
4. disabled Enable fuzzy CPE matching. for internal analyser.
5. clicked on reanalyze in audit vulnerabilities section.
6. The vulnerabilities are as before
7. used api call : https://dependencytrack.abilityplatform.abb/api/v1/finding/project/a3e256bd-3dd6-44b3-a7c6-750a34b6c87b/analyze

But still same result

Expected Behavior

Once we disable Enable fuzzy CPE matching. for internal analyser. and click reanalyze it should remove all the unassociated vulnerabilities for components.

Dependency-Track Version

4.12.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

12.0

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[xurizaemon]

5. clicked on reanalyze in audit vulnerabilities section

This was unclear to me, so leaving a note for future people :)

• "Audit vulnerabilities" is /projects/{uuid}/findings, a tab when viewing Projects - this has a Reanalyze button ✔️ 😄
• "Vulnerability Audit" in sidebar is /vulnerabilityAudit - this does not have a "Reanalyze" button ❌

You can also tap the endpoint with curl:

curl -X POST 'https://dt-api.example.org/api/v1/finding/project/{project_uuid}/analyze' -H 'X-Api-Key: {api_key}' | jq

[ishararsyngentl]

Additional Findings – Cached Vulnerabilities Not Clearing

We observed that vulnerability results appear to be cached and not fully invalidated when re-triggering analysis after changing analyzer settings.

Summary of the Issue

Disabling “Enable fuzzy CPE matching (internal analyzer)” and triggering reanalysis (via UI or API) does not remove previously detected vulnerabilities that are no longer associated with any components.

However, re-uploading the same SBOM clears the stale/unassociated vulnerabilities correctly.
This indicates that the reanalysis flow is not fully invalidating or rebuilding cached findings.

Impact

This behavior can lead to:

• Incorrect vulnerability results being displayed
• False positives remaining after analyzer configuration changes
• Inconsistent results between Reanalyze vs Re-upload SBOM

Temporary Workaround (Not Recommended for Production)

To validate that the issue is related to cached data, we manually cleared relevant tables at the database level in Dependency-Track v4.13.6 (PostgreSQL backend).
After truncating these tables and re-triggering analysis, the vulnerability results were recalculated correctly.

// SQL
TRUNCATE TABLE "COMPONENTS_VULNERABILITIES" CASCADE;
TRUNCATE TABLE "FINDINGATTRIBUTION" CASCADE;
TRUNCATE TABLE "COMPONENTANALYSISCACHE" CASCADE;
TRUNCATE TABLE "ANALYSIS" CASCADE;
TRUNCATE TABLE "AFFECTEDVERSIONATTRIBUTION" CASCADE;

This is only a diagnostic workaround and is not suitable for production environments.

Expected Behavior

When disabling fuzzy CPE matching and triggering reanalysis (via UI or API),
Dependency-Track should:

• Invalidate existing vulnerability findings
• Recalculate findings based on the updated analyzer configuration
• Remove vulnerabilities that are no longer associated with any components

Suggestion

Reanalysis should fully invalidate:

• Component analysis cache
• Vulnerability associations
• Affected version mappings

so that analyzer configuration changes are correctly reflected without requiring an SBOM re-upload or database intervention.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.