SonarQube Flags v5.0.6

[christopheretter]

The SonarQube OWASP vulnerability warning is flagging this new version, I don't know the reason, but I figured I'd mention it because it stopped our deployments.

[juliangruber]

Do you know which components with known vulnerabilities it's using?

[bbossola]

This is an error coming from the NVD database:
https://www.cve.org/CVERecord?id=CVE-2026-45149

Their range is incorrect. We are applying a range correction as we speak (spoiler: we are SCA company :))

[bbossola]

The range appears to be correct on GHA:
GHSA-jxxr-4gwj-5jf2

[juliangruber]

Is there anything I can do here to help? A change on the repository or the advisory?

[juliangruber]

GHSA-jxxr-4gwj-5jf2 describes 5.0.6 as the first patched version

[bbossola]

I think that locally people can ignore that CVE on their own scanners. On your side, you can try to contact the NVD to ask for a correction but it will take a lot of time in our experience.