CVE-2025-59250 false positive: bump mssql-jdbc to 13.4.0.jre11 - #856
Merged
vharseko merged 1 commit intoAug 7, 2026
Merged
Conversation
The bundled 12.10.2.jre11 jar is already patched, but its embedded pom.properties says "12.10.2", which Trivy compares against the fixed version 12.10.2.jre11 and reports as vulnerable. 13.4.0 is outside all affected ranges, so the scanner no longer flags it.
vharseko
added
security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trivy flags the packaged server with CVE-2025-59250 even though the bundled
mssql-jdbc-12.10.2.jre11.jaris already the patched release: Microsoft writes a truncatedversion=12.10.2into the jar's embeddedMETA-INF/.../pom.properties, and Trivy compares that string against the fixed version12.10.2.jre11(12.10.2 < 12.10.2.jre11), so the alert never clears. The same truncation exists in every.jre11build of the affected lines, so bumping within the 12.10.x line would not help.Upgrading to
13.4.0.jre11(latest stable) resolves it: the embedded version13.4.0is outside all affected ranges of GHSA-m494-w24q-6f7w, and OSV reports no known vulnerabilities for 13.4.0.The driver is only loaded via
DriverManager(no compile-time usage), andmvn dependency:resolveconfirms the new artifact resolves.