OSSIndexAnalyzer cannot parse some CVSS vector strings

[chadlwilson]

Describe the bug
At time of writing OSSIndex/Guide results for this library cannot be parsed.

Failed to fetch component-report for: pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE
java.lang.IllegalArgumentException: L
        at io.github.jeremylong.openvulnerability.client.nvd.ValueMappable.getOrThrow(ValueMappable.java:60)
        at io.github.jeremylong.openvulnerability.client.nvd.VectorMappable.lambda$create$1(VectorMappable.java:53)
        at io.github.jeremylong.openvulnerability.client.nvd.CvssV2Data$CiaType.fromValue(CvssV2Data.java:631)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.transform(OssIndexAnalyzer.java:399)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.lambda$enrich$0(OssIndexAnalyzer.java:335)
        at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
        at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1716)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:570)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:560)
        at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:153)
        at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:176)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:265)
        at java.base/java.util.stream.ReferencePipeline.forEachOrdered(ReferencePipeline.java:637)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.enrich(OssIndexAnalyzer.java:336)
        at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.analyzeDependency(OssIndexAnalyzer.java:204)
        at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)

Version of dependency-check used
13.0.0 via Gradle

To Reproduce
Will attach better steps later, but scan a POm with the above dependency in it with OSSindex credentials set should be enough.

Expected behavior
Vulns should be able to be parsed

Additional context
The code seems to be falling back to a CVSS2 parse and then seeing an L for CIA type, which is invalid. Probably need to check the raw response and figure out if the data is bad, or the parsing is bad.

DependencyCheck/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java

Lines 378 to 396 in 02bb473

	final CvssVector cvssVector = CvssVectorFactory.create(source.getCvssVector());
	final Map<String, String> metrics = cvssVector.getMetrics();
	if (cvssVector instanceof Cvss2Vector) {
	String tmp = metrics.get(Cvss2Vector.ACCESS_VECTOR);
	CvssV2Data.AccessVectorType accessVector = null;
	if (tmp != null) {
	accessVector = CvssV2Data.AccessVectorType.fromValue(tmp);
	}
	tmp = metrics.get(Cvss2Vector.ACCESS_COMPLEXITY);
	CvssV2Data.AccessComplexityType accessComplexity = null;
	if (tmp != null) {
	accessComplexity = CvssV2Data.AccessComplexityType.fromValue(tmp);
	}
	tmp = metrics.get(Cvss2Vector.AUTHENTICATION);
	CvssV2Data.AuthenticationType authentication = null;
	if (tmp != null) {
	authentication = CvssV2Data.AuthenticationType.fromValue(tmp);
	}
	tmp = metrics.get(Cvss2Vector.CONFIDENTIALITY_IMPACT);

[chadlwilson]

The problem seems to be CVE-2026-59283; whose ComponentReport.getCvssVector() is returning AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H : https://guide.sonatype.com/vulnerability/CVE-2026-59283 via the "Fast Track Process" claiming NVD origin. It's still not public on NVD at time of origin, so Sonatype must have scored it.

It's missing a CVSS:3 classifier, but looks like a 3.0 or 3.1 preable, and parses OK if forced as such:

CvssUtil.vectorToCvssV3("CVSS:3.1/" + source.getCvssVector(), 7.6)

Clearly the problem is with Sonatype Guide (vector string is invalid), however the fallback to assume it's a 2.0 string seems a bit suspect. Sonatype's own OSSIndex code requires that 3.x vectors are prefixed with CVSS:3.0 in their own OSS Index code. Not sure if we should just trial and error against different versions, if this is a "won't fix", or whether we should stop assuming it is CVSS 2 as the fallback option which gives a misleading error.