Lots of CVEs not detected

[devtobi]

Description

Today I observed a strange behaviour where a lot of official CVEs are not found on https://avd.aquasec.com/ or when using Trivy as a scan tool.
I am using trivy through the current GitHub Action (Version 0.36.0)

Some examples are:

• CVE-2026-34483
• CVE-2026-34486
• CVE-2026-34487
• CVE-2026-40973

I know that those where reported by Trivy in the past and I am confused why that no longer is the case.

I also stumbled across #10691 but not sure if those belong together.

Desired Behavior

CVEs that where detected in the past should still be detected.

Actual Behavior

Above mentioned CVEs are not reported.

Reproduction Steps

Use this `.pom` file to reproduce the error


<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.5.13</version>
    <relativePath/> <!-- lookup parent from repository -->
  </parent>
  <groupId>com.example</groupId>
  <artifactId>demo</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <properties>
    <java.version>21</java.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
      </plugin>
    </plugins>
  </build>

</project>


Trivy does not detect the CVE `CVE-2026-34483` for the dependency `tomcat-embed-core:10.1.35`

Target

Filesystem

Scanner

Vulnerability

Output Format

JSON

Mode

None

Debug Output

Not available

Operating System

Ubuntu 24.04 (GitHub Runner)

Version

0.70.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @devtobi !

Thanks for the report. I reproduced this with your pom.xml and the cause is remote dependency resolution being rate-limited by Maven Central, not missing CVEs in the database.

What happens:

In your POM, spring-boot-starter-web has no explicit version, and tomcat-embed-core:10.1.35 is a transitive dependency. Both versions come from the spring-boot-starter-parent BOM, so Trivy has to fetch the parent and dependency POMs from Maven Central to resolve them. If those fetches fail, the affected packages never enter the SBOM, so there is nothing to match the CVEs against — the scan finishes "clean".

Since May 2026, Maven Central enforces much stricter rate limits, and a shared CI IP (GitHub-hosted runner) with an empty ~/.m2 hits 429 Too Many Requests quickly. Running your exact POM, I get:

FATAL  Error  remote Maven repository returned 429 Too Many Requests for
https://repo.maven.apache.org/maven2/jakarta/annotation/jakarta.annotation-api/2.1.1/jakarta.annotation-api-2.1.1.pom. Retry-After: 1800.
The repository blocks all subsequent requests from this IP until the block clears.

This is the same root cause as #10691.

I verified the database directly (bbolt). Both the vulnerability detail CVE-2026-34483 and the GHSA Maven advisory for org.apache.tomcat.embed:tomcat-embed-core are present, with vulnerable range >=10.1.0-M1, <10.1.54 (patched in 10.1.54), which includes 10.1.35.

Why you saw a silent "no issues". You are on 0.70.0, where a 429 was only logged at DEBUG and the dependency was silently skipped, so the scan exited successfully with an incomplete result. From the version with the #10691 fix onward, the 429 is surfaced as a fatal error instead of being swallowed.

What to do:

• Upgrade to a version that includes the bug(pom): 429 from remote Maven repository is silently swallowed, producing incomplete scan results #10691 fix so the rate limit is reported instead of hidden.
• Populate the local Maven cache before scanning so Trivy reads POMs from ~/.m2 instead of the network, e.g. run mvn dependency:resolve and cache ~/.m2 in CI.

[nikpivkin]

Regarding the missing CVEs on the AVD website, this is tracked separately in this discussion.

[hupling]

isn't it better to generate a sbom and scan the sbom with trivy? Then trivy doesn't need to resolve any maven dependencies.

mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
trivy sbom target/bom.json

we have also the problem that child dependencies can not resolved https://github.com/glelarge/trivy-maven-issue

WARN [pom] Dependency version cannot be determined. Child dependencies will not be found. details="https://trivy.dev/docs/v0.69/guide/coverage/language/java#empty-dependency-version"

[nikpivkin]

@hupling Yes - that's a good workaround.