Cannot complete initial NVD download - 503 status

Describe the bug
The default configuration, with an API key, is either making requests too quickly, or not retrying enough, or both. It always eventually fails with a 503 error from NVD.
Version of dependency-check used
Maven plugin 9.0.0
Log file
[INFO] --- dependency-check:9.0.0:check (default-cli) @ test ---
[INFO] Checking for updates
[INFO] NVD API has 171,358 records in this update
[INFO] Downloaded 20,000/171,358 (12%)
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:336)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:110)
    at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
    at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
    at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1936)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1119)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
    at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
    at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
    at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.apache.maven.wrapper.BootstrapMainStarter.start (BootstrapMainStarter.java:52)
    at org.apache.maven.wrapper.WrapperExecutor.execute (WrapperExecutor.java:161)
    at org.apache.maven.wrapper.MavenWrapperMain.main (MavenWrapperMain.java:73)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503
    at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:327)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:315)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:110)
    at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
    at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
    at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1936)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1119)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
    at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
    at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
    at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.apache.maven.wrapper.BootstrapMainStarter.start (BootstrapMainStarter.java:52)
    at org.apache.maven.wrapper.WrapperExecutor.execute (WrapperExecutor.java:161)
    at org.apache.maven.wrapper.MavenWrapperMain.main (MavenWrapperMain.java:73)
[INFO] Skipping RetireJS update since last update was within 24 hours.
[INFO] Skipping Hosted Suppressions file update since last update was within 2 hours.
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[ERROR] Fatal exception(s) analyzing Test
[INFO] Cache event queue destroyed: CacheEventQueue [listenerId=-135459835, cacheName=NODEAUDIT]
[INFO] Cache event queue destroyed: CacheEventQueue [listenerId=-135459835, cacheName=CENTRAL]
[INFO] Cache event queue destroyed: CacheEventQueue [listenerId=-135459835, cacheName=POM]
[ERROR] Region [NODEAUDIT] : Not alive and dispose was called, filename: NODEAUDIT
[ERROR] Region [CENTRAL] : Not alive and dispose was called, filename: CENTRAL
[ERROR] Region [POM] : Not alive and dispose was called, filename: POM

The debug log in this case is a nightmare as it logs every raw request and response, 16 bytes at a time, without synchronisation so they're all misordered. I'm not going through that to sanitise my API key.
To Reproduce
mvn dependency-check:check
Expected behavior
Successful completion of the download.

Same for me.

It looks like perhaps there is a retry mechanism, but for some reason the connection pool has been closed and it doesn't do anything about it.
(This log is interleaved with other
[DEBUG] Shutdown connection pool GRACEFUL
[DEBUG] c-0000000006 Shutdown connection GRACEFUL
[DEBUG] Connection pool shut down
[DEBUG] Shutdown GRACEFUL
[DEBUG] c-0000000007[ACTIVE][rw:w][ACTIVE][rw][NOT_HANDSHAKING][0][0][0] Enqueued ShutdownCommand with priority IMMEDIATE
[DEBUG] c-0000000007[ACTIVE][r:w][ACTIVE][r][NOT_HANDSHAKING][0][0][0] Event cleared [w]
[DEBUG] c-0000000007[ACTIVE][rw:w][ACTIVE][rw][NOT_HANDSHAKING][0][0][0] Event set [w]
[DEBUG] ex-0000000008: consume response data, len 8192 bytes
[DEBUG] ex-0000000008: consume response data, len 8128 bytes
[DEBUG] c-0000000007[ACTIVE][r:w][ACTIVE][r][NOT_HANDSHAKING][0][0][0] Event cleared [w]
[DEBUG] ex-0000000008: execution failed: Connection is closed
[DEBUG] ex-0000000008 request failed: Connection is closed
[DEBUG] ep-0000000008 close IMMEDIATE
[DEBUG] ep-0000000008 endpoint closed
[DEBUG] ep-0000000008 discarding endpoint
[DEBUG] ep-0000000008 releasing endpoint
[DEBUG] ep-0000000008 connection released [route: {s}->https://services.nvd.nist.gov:443][total available: 0; route allocated: 0 of 5; total allocated: 0 of 25]
[DEBUG] request failed
org.apache.hc.core5.http.ConnectionClosedException: Connection is closed
    at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamDuplexer.disconnected (ClientHttp1StreamDuplexer.java:205)
    at org.apache.hc.core5.http.impl.nio.AbstractHttp1StreamDuplexer.onDisconnect (AbstractHttp1StreamDuplexer.java:409)
    at org.apache.hc.core5.http.impl.nio.AbstractHttp1IOEventHandler.disconnected (AbstractHttp1IOEventHandler.java:95)
    at org.apache.hc.core5.http.impl.nio.ClientHttp1IOEventHandler.disconnected (ClientHttp1IOEventHandler.java:41)
    at org.apache.hc.client5.http.impl.async.LoggingIOSession$1.disconnected (LoggingIOSession.java:258)
    at org.apache.hc.core5.reactor.ssl.SSLIOSession$1.disconnected (SSLIOSession.java:247)
    at org.apache.hc.core5.reactor.InternalDataChannel.disconnected (InternalDataChannel.java:204)
    at org.apache.hc.core5.reactor.SingleCoreIOReactor.processClosedSessions (SingleCoreIOReactor.java:231)
    at org.apache.hc.core5.reactor.SingleCoreIOReactor.doExecute (SingleCoreIOReactor.java:133)
    at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute (AbstractSingleCoreIOReactor.java:86)
    at org.apache.hc.core5.reactor.IOReactorWorker.run (IOReactorWorker.java:44)
    at java.lang.Thread.run (Thread.java:829)
[DEBUG] Ticket returned At: 17:11:13; count: 23
[DEBUG] Ticket taken At: 17:11:13; count: 24
[DEBUG] Requested At: 17:11:13; URI: /rest/json/cves/2.0?virtualMatchString=cpe%3A2.3%3Aa%3A&resultsPerPage=2000&startIndex=22000
[DEBUG] ex-0000000025 preparing request execution
[DEBUG] ex-0000000025 target auth state: UNCHALLENGED
[DEBUG] ex-0000000025 proxy auth state: UNCHALLENGED
[DEBUG] ex-0000000025 acquiring connection with route {s}->https://services.nvd.nist.gov:443
[DEBUG] ex-0000000025 acquiring endpoint (3 MINUTES)
[DEBUG] ex-0000000025 endpoint lease request (3 MINUTES) [route: {s}->https://services.nvd.nist.gov:443][total available: 0; route allocated: 0 of 5; total allocated: 0 of 25]
[DEBUG] request failed
java.lang.IllegalStateException: Connection pool shut down
    at org.apache.hc.core5.util.Asserts.check (Asserts.java:38)
    at org.apache.hc.core5.pool.StrictConnPool.lease (StrictConnPool.java:176)
    at org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManager$3.<init> (PoolingAsyncClientConnectionManager.java:271)
    at org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManager.lease (PoolingAsyncClientConnectionManager.java:266)
    at org.apache.hc.client5.http.impl.async.InternalHttpAsyncExecRuntime.acquireEndpoint (InternalHttpAsyncExecRuntime.java:105)
    at org.apache.hc.client5.http.impl.async.AsyncConnectExec.execute (AsyncConnectExec.java:141)
    at org.apache.hc.client5.http.impl.async.AsyncExecChainElement.execute (AsyncExecChainElement.java:54)
    at org.apache.hc.client5.http.impl.async.AsyncProtocolExec.internalExecute (AsyncProtocolExec.java:207)
    at org.apache.hc.client5.http.impl.async.AsyncProtocolExec.execute (AsyncProtocolExec.java:172)
    at org.apache.hc.client5.http.impl.async.AsyncExecChainElement.execute (AsyncExecChainElement.java:54)
    at org.apache.hc.client5.http.impl.async.AsyncHttpRequestRetryExec.internalExecute (AsyncHttpRequestRetryExec.java:97)
    at org.apache.hc.client5.http.impl.async.AsyncHttpRequestRetryExec.execute (AsyncHttpRequestRetryExec.java:184)
    at org.apache.hc.client5.http.impl.async.AsyncExecChainElement.execute (AsyncExecChainElement.java:54)
    at org.apache.hc.client5.http.impl.async.AsyncRedirectExec.internalExecute (AsyncRedirectExec.java:112)
    at org.apache.hc.client5.http.impl.async.AsyncRedirectExec.execute (AsyncRedirectExec.java:278)
    at org.apache.hc.client5.http.impl.async.AsyncExecChainElement.execute (AsyncExecChainElement.java:54)
    at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient.executeImmediate (InternalAbstractHttpAsyncClient.java:347)
    at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient.lambda$doExecute$0 (InternalAbstractHttpAsyncClient.java:205)
    at org.apache.hc.core5.http.nio.support.BasicRequestProducer.sendRequest (BasicRequestProducer.java:93)
    at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient.doExecute (InternalAbstractHttpAsyncClient.java:178)
    at org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient.execute (CloseableHttpAsyncClient.java:97)
    at org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient.execute (CloseableHttpAsyncClient.java:107)
    at org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient.execute (CloseableHttpAsyncClient.java:124)
    at org.apache.hc.client5.http.impl.async.CloseableHttpAsyncClient.execute (CloseableHttpAsyncClient.java:130)
    at io.github.jeremylong.openvulnerability.client.nvd.RateLimitedClient.delayedExecute (RateLimitedClient.java:179)
    at io.github.jeremylong.openvulnerability.client.nvd.RateLimitedClient.lambda$execute$0 (RateLimitedClient.java:152)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)
[DEBUG] Ticket returned At: 17:11:13; count: 24
[DEBUG] Rate Limited API call - waiting for 2000ms
[DEBUG] Ticket taken At: 17:11:13; count: 25
[DEBUG] Requested At: 17:11:13; URI: /rest/json/cves/2.0?virtualMatchString=cpe%3A2.3%3Aa%3A&resultsPerPage=2000&startIndex=58000
[DEBUG] ex-0000000026 preparing request execution
[DEBUG] ex-0000000026 target auth state: UNCHALLENGED
[DEBUG] ex-0000000026 proxy auth state: UNCHALLENGED
[DEBUG] ex-0000000026 acquiring connection with route {s}->https://services.nvd.nist.gov:443
[DEBUG] ex-0000000026 acquiring endpoint (3 MINUTES)
[DEBUG] ex-0000000026 endpoint lease request (3 MINUTES) [route: {s}->https://services.nvd.nist.gov:443][total available: 0; route allocated: 0 of 5; total allocated: 0 of 25]
[DEBUG] request failed
java.lang.IllegalStateException: Connection pool shut down

That repeats for a bit, with the ex-00000... number continuing to increment.

Can you try increasing the delay?  For the CLI it would be --nvdApiDelay 16000?

By default it is attempting to use 8000 without an API key.

I’m using an API key and still getting a 503 after a while what should I try for the delay value?On Nov 22, 2023, at 19:07, Jeremy Long @.***> wrote:
By default it is attempting to use 8000 without an API key.
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: @.***>

I am using the gradle plugin with the following:
dependencyCheck {
    nvd {
        apiKey = '<my-api-key>'
        delay = 16000
    }
}

Still result in 503:
$ ./gradlew dependencyCheckAnalyze

> Task :dependencyCheckAnalyze
Verifying dependencies for project access
Checking for updates and analyzing dependencies for vulnerabilities
Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:336)
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110)
        at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:902)
        at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:707)
        at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:633)
        at org.owasp.dependencycheck.gradle.tasks.AbstractAnalyze.analyze(AbstractAnalyze.groovy:100)
        at java.base@17.0.9/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base@17.0.9/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base@17.0.9/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base@17.0.9/java.lang.reflect.Method.invoke(Method.java:568)
        at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:125)
        at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58)
        at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51)
        at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29)
        at org.gradle.api.internal.tasks.execution.TaskExecution$3.run(TaskExecution.java:248)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:157)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.run(DefaultBuildOperationRunner.java:47)
        at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:73)
        at org.gradle.api.internal.tasks.execution.TaskExecution.executeAction(TaskExecution.java:233)
        at org.gradle.api.internal.tasks.execution.TaskExecution.executeActions(TaskExecution.java:216)
        at org.gradle.api.internal.tasks.execution.TaskExecution.executeWithPreviousOutputFiles(TaskExecution.java:199)
        at org.gradle.api.internal.tasks.execution.TaskExecution.execute(TaskExecution.java:166)
        at org.gradle.internal.execution.steps.ExecuteStep.executeInternal(ExecuteStep.java:105)
        at org.gradle.internal.execution.steps.ExecuteStep.access$000(ExecuteStep.java:44)
        at org.gradle.internal.execution.steps.ExecuteStep$1.call(ExecuteStep.java:59)
        at org.gradle.internal.execution.steps.ExecuteStep$1.call(ExecuteStep.java:56)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:204)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:199)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:157)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.call(DefaultBuildOperationRunner.java:53)
        at org.gradle.internal.operations.DefaultBuildOperationExecutor.call(DefaultBuildOperationExecutor.java:78)
        at org.gradle.internal.execution.steps.ExecuteStep.execute(ExecuteStep.java:56)
        at org.gradle.internal.execution.steps.ExecuteStep.execute(ExecuteStep.java:44)
        at org.gradle.internal.execution.steps.RemovePreviousOutputsStep.execute(RemovePreviousOutputsStep.java:67)
        at org.gradle.internal.execution.steps.RemovePreviousOutputsStep.execute(RemovePreviousOutputsStep.java:37)
        at org.gradle.internal.execution.steps.CancelExecutionStep.execute(CancelExecutionStep.java:41)
        at org.gradle.internal.execution.steps.TimeoutStep.executeWithoutTimeout(TimeoutStep.java:74)
        at org.gradle.internal.execution.steps.TimeoutStep.execute(TimeoutStep.java:55)
        at org.gradle.internal.execution.steps.CreateOutputsStep.execute(CreateOutputsStep.java:50)
        at org.gradle.internal.execution.steps.CreateOutputsStep.execute(CreateOutputsStep.java:28)
        at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.executeDelegateBroadcastingChanges(CaptureStateAfterExecutionStep.java:100)
        at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.execute(CaptureStateAfterExecutionStep.java:72)
        at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.execute(CaptureStateAfterExecutionStep.java:50)
        at org.gradle.internal.execution.steps.ResolveInputChangesStep.execute(ResolveInputChangesStep.java:40)
        at org.gradle.internal.execution.steps.ResolveInputChangesStep.execute(ResolveInputChangesStep.java:29)
        at org.gradle.internal.execution.steps.BuildCacheStep.executeWithoutCache(BuildCacheStep.java:179)
        at org.gradle.internal.execution.steps.BuildCacheStep.lambda$execute$1(BuildCacheStep.java:70)
        at org.gradle.internal.Either$Right.fold(Either.java:175)
        at org.gradle.internal.execution.caching.CachingState.fold(CachingState.java:59)
        at org.gradle.internal.execution.steps.BuildCacheStep.execute(BuildCacheStep.java:68)
        at org.gradle.internal.execution.steps.BuildCacheStep.execute(BuildCacheStep.java:46)
        at org.gradle.internal.execution.steps.StoreExecutionStateStep.execute(StoreExecutionStateStep.java:36)
        at org.gradle.internal.execution.steps.StoreExecutionStateStep.execute(StoreExecutionStateStep.java:25)
        at org.gradle.internal.execution.steps.RecordOutputsStep.execute(RecordOutputsStep.java:36)
        at org.gradle.internal.execution.steps.RecordOutputsStep.execute(RecordOutputsStep.java:22)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.executeBecause(SkipUpToDateStep.java:91)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.lambda$execute$2(SkipUpToDateStep.java:55)
        at java.base@17.0.9/java.util.Optional.orElseGet(Optional.java:364)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.execute(SkipUpToDateStep.java:55)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.execute(SkipUpToDateStep.java:37)
        at org.gradle.internal.execution.steps.ResolveChangesStep.execute(ResolveChangesStep.java:65)
        at org.gradle.internal.execution.steps.ResolveChangesStep.execute(ResolveChangesStep.java:36)
        at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsFinishedStep.execute(MarkSnapshottingInputsFinishedStep.java:37)
        at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsFinishedStep.execute(MarkSnapshottingInputsFinishedStep.java:27)
        at org.gradle.internal.execution.steps.ResolveCachingStateStep.execute(ResolveCachingStateStep.java:77)
        at org.gradle.internal.execution.steps.ResolveCachingStateStep.execute(ResolveCachingStateStep.java:38)
        at org.gradle.internal.execution.steps.ValidateStep.execute(ValidateStep.java:108)
        at org.gradle.internal.execution.steps.ValidateStep.execute(ValidateStep.java:55)
        at org.gradle.internal.execution.steps.CaptureStateBeforeExecutionStep.execute(CaptureStateBeforeExecutionStep.java:71)
        at org.gradle.internal.execution.steps.CaptureStateBeforeExecutionStep.execute(CaptureStateBeforeExecutionStep.java:45)
        at org.gradle.internal.execution.steps.SkipEmptyWorkStep.executeWithNonEmptySources(SkipEmptyWorkStep.java:177)
        at org.gradle.internal.execution.steps.SkipEmptyWorkStep.execute(SkipEmptyWorkStep.java:81)
        at org.gradle.internal.execution.steps.SkipEmptyWorkStep.execute(SkipEmptyWorkStep.java:53)
        at org.gradle.internal.execution.steps.RemoveUntrackedExecutionStateStep.execute(RemoveUntrackedExecutionStateStep.java:32)
        at org.gradle.internal.execution.steps.RemoveUntrackedExecutionStateStep.execute(RemoveUntrackedExecutionStateStep.java:21)
        at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsStartedStep.execute(MarkSnapshottingInputsStartedStep.java:38)
        at org.gradle.internal.execution.steps.LoadPreviousExecutionStateStep.execute(LoadPreviousExecutionStateStep.java:36)
        at org.gradle.internal.execution.steps.LoadPreviousExecutionStateStep.execute(LoadPreviousExecutionStateStep.java:23)
        at org.gradle.internal.execution.steps.CleanupStaleOutputsStep.execute(CleanupStaleOutputsStep.java:75)
        at org.gradle.internal.execution.steps.CleanupStaleOutputsStep.execute(CleanupStaleOutputsStep.java:41)
        at org.gradle.internal.execution.steps.ExecuteWorkBuildOperationFiringStep.lambda$execute$2(ExecuteWorkBuildOperationFiringStep.java:66)
        at java.base@17.0.9/java.util.Optional.orElseGet(Optional.java:364)
        at org.gradle.internal.execution.steps.ExecuteWorkBuildOperationFiringStep.execute(ExecuteWorkBuildOperationFiringStep.java:66)
        at org.gradle.internal.execution.steps.ExecuteWorkBuildOperationFiringStep.execute(ExecuteWorkBuildOperationFiringStep.java:38)
        at org.gradle.internal.execution.steps.AssignWorkspaceStep.lambda$execute$0(AssignWorkspaceStep.java:32)
        at org.gradle.api.internal.tasks.execution.TaskExecution$4.withWorkspace(TaskExecution.java:293)
        at org.gradle.internal.execution.steps.AssignWorkspaceStep.execute(AssignWorkspaceStep.java:30)
        at org.gradle.internal.execution.steps.AssignWorkspaceStep.execute(AssignWorkspaceStep.java:21)
        at org.gradle.internal.execution.steps.IdentityCacheStep.execute(IdentityCacheStep.java:37)
        at org.gradle.internal.execution.steps.IdentityCacheStep.execute(IdentityCacheStep.java:27)
        at org.gradle.internal.execution.steps.IdentifyStep.execute(IdentifyStep.java:47)
        at org.gradle.internal.execution.steps.IdentifyStep.execute(IdentifyStep.java:34)
        at org.gradle.internal.execution.impl.DefaultExecutionEngine$1.execute(DefaultExecutionEngine.java:64)
        at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeIfValid(ExecuteActionsTaskExecuter.java:145)
        at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.execute(ExecuteActionsTaskExecuter.java:134)
        at org.gradle.api.internal.tasks.execution.FinalizePropertiesTaskExecuter.execute(FinalizePropertiesTaskExecuter.java:46)
        at org.gradle.api.internal.tasks.execution.ResolveTaskExecutionModeExecuter.execute(ResolveTaskExecutionModeExecuter.java:51)
        at org.gradle.api.internal.tasks.execution.SkipTaskWithNoActionsExecuter.execute(SkipTaskWithNoActionsExecuter.java:57)
        at org.gradle.api.internal.tasks.execution.SkipOnlyIfTaskExecuter.execute(SkipOnlyIfTaskExecuter.java:74)
        at org.gradle.api.internal.tasks.execution.CatchExceptionTaskExecuter.execute(CatchExceptionTaskExecuter.java:36)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.executeTask(EventFiringTaskExecuter.java:77)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.call(EventFiringTaskExecuter.java:55)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.call(EventFiringTaskExecuter.java:52)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:204)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:199)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:157)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.call(DefaultBuildOperationRunner.java:53)
        at org.gradle.internal.operations.DefaultBuildOperationExecutor.call(DefaultBuildOperationExecutor.java:78)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter.execute(EventFiringTaskExecuter.java:52)
        at org.gradle.execution.plan.LocalTaskNodeExecutor.execute(LocalTaskNodeExecutor.java:42)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$InvokeNodeExecutorsAction.execute(DefaultTaskExecutionGraph.java:331)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$InvokeNodeExecutorsAction.execute(DefaultTaskExecutionGraph.java:318)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.lambda$execute$0(DefaultTaskExecutionGraph.java:314)
        at org.gradle.internal.operations.CurrentBuildOperationRef.with(CurrentBuildOperationRef.java:80)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.execute(DefaultTaskExecutionGraph.java:314)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.execute(DefaultTaskExecutionGraph.java:303)
        at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.execute(DefaultPlanExecutor.java:463)
        at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.run(DefaultPlanExecutor.java:380)
        at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:64)
        at org.gradle.internal.concurrent.AbstractManagedExecutor$1.run(AbstractManagedExecutor.java:47)
        at java.base@17.0.9/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base@17.0.9/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base@17.0.9/java.lang.Thread.run(Thread.java:840)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503
        at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:327)
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:315)
        ... 133 more
Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
Unable to continue dependency-check analysis.

Region [NODEAUDIT] : Not alive and dispose was called, filename: NODEAUDIT
Region [CENTRAL] : Not alive and dispose was called, filename: CENTRAL
Region [POM] : Not alive and dispose was called, filename: POM

> Task :dependencyCheckAnalyze FAILED

yup... apparently the NVD API is under load... maybe they'll delay the retirement of the data feeds...

same is happening for me.

Yeah even with DT and API key I'm getting rate limited to no end.

@jeremylong maybe they'll delay the retirement of the data feeds...

If that is the outcome then it'd be a win for everyone 😆 DC adopting the NVD REST API must be one of the most brutal load tests you can get! 9.0 was only released today so I'm assuming the situation will not get better as folks proceed with upgrading.

Can you try increasing the delay? For the CLI it would be --nvdApiDelay 16000?

Not sure if it's relevant. I've tried a 300000ms delay with vulnz (with or without API key), but still getting 503 after a couple requests.

I'm getting 404s now (while using an API key) - wonder if it's related or something else bad in the API data or dep check's use of it.
Checking for updates
Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:336)
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110)
        at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:902)
        at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:707)
        at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:633)
        at org.owasp.dependencycheck.gradle.tasks.AbstractAnalyze.analyze(AbstractAnalyze.groovy:100)
       ... SNIP
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 404
        at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:327)
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:315)
        ... 165 more

Yes, I also experienced 503 with or without the NVD API Key.

I have the same problem

Same situation here with an API Key 😞

Same here - despite 16k delay.

Same here...404
One or more exceptions occurred during analysis:
UpdateException: Error updating the NVD Data
caused by NvdApiException: NVD Returned Status Code: 404
NoDataException: No documents exist
I have the nvdApiKey set and 16000.

Looks like the 404s are most likely be to do with invalid API Keys, according to https://github.com/jeremylong/Open-Vulnerability-Project/tree/main/vulnz#api-key-is-used-and-a-404-error-occurs (with some speculation about NVD giving out API keys that don't work here, as would seem likely in my case as I am pretty confident my key was correct).
Regenerated my key and am now onto the 503s like others :-)

@chadlwilson Yep.  Ran the test curl -H "Accept: application/json" -H "apiKey: ########-####-####-####-############" -v https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
The key was bad.  Requested and new one, and the second one they sent me works.  Looks like they have some issues to workout with this new API.

@chadlwilson How are you supposed to list the API key in nvdApiKey?
apiKey: ########-####-####-####-############
or
########-####-####-####-############

########-####-####-####-############

Just the key on its own. The header is populated by the library: https://github.com/jeremylong/Open-Vulnerability-Project/blob/27c72f84943d28448a867f803c699867fcb864d3/open-vulnerability-clients/src/main/java/io/github/jeremylong/openvulnerability/client/nvd/NvdCveClient.java#L235-L237

The curl command is working fine, but from the plugin it getting a 503...
One or more exceptions occurred during analysis:
UpdateException: Error updating the NVD Data
caused by NvdApiException: NVD Returned Status Code: 503
NoDataException: No documents exist

I had to add  16000 back, now it's working.  There was about a 30 second delay before it finally started to download.

@chadlwilson Have you tested with maven parallel builds before?  We build with -T1C and it's looking like it might be attempting to just multiple threads to connect to the API.

Looks like they have some issues to work on.  I bumped up  <nvdApiDelay>32000</nvdApiDelay>. It got further this time, but eventually failed with a 503.  Here are the debug logs showing the failure.
failure.txt

Same issue also for me using the nvdApiKey and nvdApiDelay set at 16000
``
[INFO] Finished configuration in 104 ms.
[INFO] Checking for updates
Error:  Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:336)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:902)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:707)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:633)
at org.owasp.dependencycheck.App.runScan(App.java:260)
at org.owasp.dependencycheck.App.run(App.java:192)
at org.owasp.dependencycheck.App.main(App.java:87)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:327)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:315)
... 7 common frames omitted
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (70 ms)
[WARN] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
Error:  Unable to continue dependency-check analysis.
[INFO] Element event queue destroyed: org.apache.commons.jcs3.engine.control.event.ElementEventQueue@5cde6747
[INFO] In DISPOSE, [NODEAUDIT] fromRemote [false]
[INFO] In DISPOSE, [NODEAUDIT] auxiliary [NODEAUDIT]
[INFO] In DISPOSE, [NODEAUDIT] put 0 into auxiliary [NODEAUDIT]
[INFO] In dispose, destroying event queue.
[INFO] Cache event queue destroyed: CacheEventQueue [listenerId=-68243966, cacheName=NODEAUDIT]
[INFO] Region [NODEAUDIT] : Saving keys to: NODEAUDIT, key count: 0
[INFO] Region [NODEAUDIT] : Finished saving keys.
[INFO] Region [NODEAUDIT] : Shutdown complete.
[INFO] In DISPOSE, [NODEAUDIT] disposing of memory cache.
[INFO] Memory Cache dispose called.
[INFO] In DISPOSE, [CENTRAL] fromRemote [false]
[INFO] In DISPOSE, [CENTRAL] auxiliary [CENTRAL]
[INFO] In DISPOSE, [CENTRAL] put 0 into auxiliary [CENTRAL]
[INFO] In dispose, destroying event queue.
[INFO] Cache event queue destroyed: CacheEventQueue [listenerId=-68243966, cacheName=CENTRAL]
[INFO] Region [CENTRAL] : Saving keys to: CENTRAL, key count: 0
[INFO] Region [CENTRAL] : Finished saving keys.
[INFO] Region [CENTRAL] : Shutdown complete.
[INFO] In DISPOSE, [CENTRAL] disposing of memory cache.
[INFO] Memory Cache dispose called.
[INFO] In DISPOSE, [POM] fromRemote [false]
[INFO] In DISPOSE, [POM] auxiliary [POM]
[INFO] In DISPOSE, [POM] put 0 into auxiliary [POM]
[INFO] In dispose, destroying event queue.
[INFO] Cache event queue destroyed: CacheEventQueue [listenerId=-68243966, cacheName=POM]
[INFO] Region [POM] : Saving keys to: POM, key count: 0
[INFO] Region [POM] : Finished saving keys.
[INFO] Region [POM] : Shutdown complete.
[INFO] In DISPOSE, [POM] disposing of memory cache.
[INFO] Memory Cache dispose called.
[INFO] In dispose, destroying event queue.
Error:  Region [NODEAUDIT] : Not alive and dispose was called, filename: NODEAUDIT
[INFO] In dispose, destroying event queue.
Error:  Region [CENTRAL] : Not alive and dispose was called, filename: CENTRAL
[INFO] In dispose, destroying event queue.
Error:  Region [POM] : Not alive and dispose was called, filename: POM
Error:  One or more fatal errors occurred
Error:  Error updating the NVD Data
Error:  No documents exist

I am having the same issue with both the command line (v9.0.0) and Azure DevOps plug-in. I get the 503 errors when testing on the command line regardless of whether I have specified an API key or not.
Reverting to v8.4.0 completes an update check and allows the completion of a scan.

Same for me. I get 503 error with or without nvdApiKey.
Can it depend on used JRE/JDK version? I'm using OpenJDK 17 (LTS).

Can it depend on used JRE/JDK version? I'm using OpenJDK 17 (LTS).

It's the NVD REST API being unable to cope with the load it's exposed to right now. Not related to the Java version at all.

It's far cheaper for them that way.

Somehow I doubt this is cost-driven. Serving static files can easily be done via CDN, way cheaper than any REST API will ever be. Being out of service constantly doesn't just make the clients useless, but the API itself as well.

@ferben Can it depend on used JRE/JDK version? I'm using OpenJDK 17 (LTS).

It's the NVD REST API being unable to cope with the load it's exposed to right now. Not related to the Java version at all.

Thank you. It also can be caused by malformed http request, typo in URL etc…

Confirmed!
Version 8.4.3 (without support of nvdApiKey) works, so there must be a issue in implementation #5978.

@ferben version 8.x doesn't use the NVD API but the NVD data feed. You can't really compare them, they probably don't even use the same servers.

@ferben version 8.x doesn't use the NVD API but the NVD data feed. You can't really compare them, they probably don't even use the same servers.

So in v9.0 should be any option --useNvdDatafeed for backward compatibility?

@ferben the point is that the NVD data feed is being removed on December 15th.

Can you please clarify this:
When I use --nvdApiKey option I use automatically NVD API calls → Understand.
When I not use --nvdApiKey i use NVD API too?
If yes, why -> dependency-check can work until NVD switch off Data feeds (NVD says 15 Dec, but if API servers is not stable they should postpone this deadline) without problems and after Data feeds would go offline users can switch to NVD API adding one option into command line.
OK, so I' pray that NVD stabilize API servers availability ASAP.

I may be missing something, but wouldn't it be more efficient for most of use cases to fetch information for specific CPEs from API instead of syncing the whole NVD database?
This won't work for offline use cases of course, where complete database sync is probably the only option.

@jeremylong a couple of questions:

Given I'm using a shared (Postgres) database which was fully up-to-date before I switched from 8.4.3 to 9.0.0, how come Dependency-Check reports NVD API has 171,457 records in this update - surely what I actually need to update is much much smaller than that?

Might it be feasible for Dependency-Check to write to the DB in the case where it fails part way through consuming from the NVD API? That is, where a shared database is in use, why does run 2 still report the same number of records (171,457) as run 1, when (and I admit I'm guessing here) run 1 might have been able to download some updates before falling over in a heap due to the API unavailability?

See the note about breaking changes

I may be missing something, but wouldn't it be more efficient for most of use cases to fetch information for specific CPEs from API instead of syncing the whole NVD database?
This won't work for offline use cases of course, where complete database sync is probably the only option.

The part you're missing is that the NVD data is not only the source for the CVEs, but also the source for 'which applicative CPEs do exist'. CPE is an identifier that is typically assigned the first time NIST receives a CVE for a product.
DependencyCheck tries to textually match components of a CPE (product, vendor) to the evidences discovered in metadata of libraries and dependencies. It's not something that is readily available for a given library.

See the note about breaking changes

Hmmm.  Looking at https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/resources/data/initialize_postgres.sql, it hasn't changed since 10 months ago, and this is the schema that I installed when I created the database.
Is there somewhere else that I should be looking for how to manage the "schema will need to be updated" part of the breaking changes to which your comment refers?

Adding myself to the list of 503-experiences here.
So, the problem is obviously not an issue in dependency-check to begin with, but rather a capacity issue (?) on the nvd api server side. Or something causing the nvd server to misbehave at least.
But maybe the symptoms could be mitigated in dependency-check after all, playing nice(er) with the server?
Suggesting (don't know if supported out of the box in whatever client library is currently used) a retry + backoff strategy. This way, fire away as many requests as possible, as quickly as possible, with an optimistic approach, but as soon the server indicates abuse (returning 503:s, 420:s or other error codes indicating server side or non critical client side errors), backoff using a delay, and increase the delay for each retry until a valid response is returned, or with a sane/configurable max-delay / max-retry setting before giving up.
Don't know how many requests a full sync would result in, but it is reasonable for everyone that a every sync attempt is eventually successful, although a bit slow, rather than restarting over and over just because one of all requests is rejected without retrying it. This would just add additional load to the nvd-server, further reducing the likeliness for anyone to succeed with a full sync.
Don't know if at all possible , but if it is, it could be worth exploring? Or perhaps this is already the current behaviour. If so, disregard this suggestion :-)

I agree with @jappaleinen since for me it downloaded more than half, and then 503 after that it started again from the beginning:
[INFO] Checking for updates
[INFO] NVD API has 171,457 records in this update
[INFO] Downloaded 20,000/171,457 (12%)
[INFO] Downloaded 40,000/171,457 (23%)
[INFO] Downloaded 60,000/171,457 (35%)
[INFO] Downloaded 80,000/171,457 (47%)
[INFO] Downloaded 100,000/171,457 (58%)
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:336)

@jeremylong @chadlwilson
I've been looking through the code and I think the issue is this...
The NVD API documentation explicitly states that maximum limit for resultsPerPage is 1000.
"resultsPerPage optional{page limit}This parameter specifies the maximum number of source records to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 1,000."
You have it hardcoded to 2000...
/**
* The number of results per page from the NVD API. The default is 2000; we
* are setting the value to be explicit.
*/
private static final int RESULTS_PER_PAGE = 2000;
This should probably be something that uses a property and is exposed as a configuration parameter in the plugin config.

@danshome I'm just another community member here 🙏
It's not cleart to me that the page size is the reason for the 503s since such responses appear to be (and typically are) fast-fail circuit breaking responses from their API gateway that may happen regardless of page size before even hitting the underlying service. This is probably why increasing delay doesn't work for an individual if the API is under sustained load and dropping x% of requests in a time period.
If we want to make ODC more robust to the challenges within the NVD infra sounds most sensible to me to explore the ability to save the results-in progress so things don't have to restart all over again, however ability to do that typically depends on the API design when dealing with paging. I haven't looked at the NVD APIs enough to personally determine if the current design is unavoidable (where it appears to restart the whole process after it has given up on a 503).
Other than that, we can hope that NVD are working on getting improved caching (CDN, gateway or internally) of their API responses in place so the situation improves in the next few weeks before the current deadline.

Even after using the key. I am still getting the same error.
[INFO] NVD API has 171,457 records in this update
[INFO] Downloaded 20,000/171,457 (12%)

[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:336)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:110)
    at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:902)
    at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:707)
    at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:633)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1936)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1119)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503

The NVD API documentation explicitly states that maximum limit for resultsPerPage is 1000.
"resultsPerPage optional{page limit}This parameter specifies the maximum number of source records to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 1,000."
You have it hardcoded to 2000...
/** * The number of results per page from the NVD API. The default is 2000; we * are setting the value to be explicit. */ private static final int RESULTS_PER_PAGE = 2000;
This should probably be something that uses a property and is exposed as a configuration parameter in the plugin config.

@danshome
Unfortunately, it looks like there are either two documentation sources or your docs are outdated. Please see
CVE API

This parameter specifies the maximum number of CVE records to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 2,000.
It is recommended that users of the CVE API use the default resultsPerPage value. This value has been optimized to allow the greatest number of results over the fewest number of requests.

I have the same issue with using the dependency-check-maven:9.0.0
mvn org.owasp:dependency-check-maven:9.0.0:check -DnvdApiKey=*** -DnvdApiDelay=16000
compare with others log, I dont even have the info for the progress part (Downloaded 20,000/171,457 (12%)), others are the same
[INFO] --- dependency-check:9.0.0:check (default-cli) @ test-project ---
[INFO] Checking for updates
[INFO] NVD API has 171▒457 records in this update
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:336)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:110)

We also experience the issue.

The NVD API documentation explicitly states that maximum limit for resultsPerPage is 1000.
"resultsPerPage optional{page limit}This parameter specifies the maximum number of source records to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 1,000."
You have it hardcoded to 2000...
/** * The number of results per page from the NVD API. The default is 2000; we * are setting the value to be explicit. */ private static final int RESULTS_PER_PAGE = 2000;
This should probably be something that uses a property and is exposed as a configuration parameter in the plugin config.

@danshome Unfortunately, it looks like there are either two documentation sources or your docs are outdated. Please see CVE API

This parameter specifies the maximum number of CVE records to be returned in a single API response. For network considerations, the default value and maximum allowable limit is 2,000.
It is recommended that users of the CVE API use the default resultsPerPage value. This value has been optimized to allow the greatest number of results over the fewest number of requests.

@mmaeller  My bad, I was looking at https://nvd.nist.gov/developers/data-sources

The only way I was able to get past the 503 errors was to add retry logic to the NvdCveClient.  Ideally the NVD API would add a Retry-After header with the 503 response, but they don't.  https://github.com/jeremylong/Open-Vulnerability-Project/pull/88

We are seeing something similar with Swift plugin. We have seen the following over the last couple of days and are seeing:
[WARN] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key [INFO] NVD API has 171,457 records in this update [ERROR] Error updating the NVD Data
Previously it looked like this:
[INFO] NVD CVE requires several updates; this could take a couple of minutes.

We are also getting the same error, we are using the dependency check in our azure devops pipeline  via azure devops extension. https://marketplace.visualstudio.com/items?itemName=dependency-check.dependencycheck
task:
  - task: dependency-check-build-task@6
    inputs:
      projectName: $(projectname)
      scanPath: '$(Build.SourcesDirectory)'
      format: 'JSON, JUNIT'
      reportsDirectory: '$(Agent.TempDirectory)/dependency-scan-results'
      reportFilename: 'dependency-check-report'
      additionalArguments: '--nvdApiKey $(NVD-API-KEY)'

error:
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:336)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:902)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:707)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:633)
at org.owasp.dependencycheck.App.runScan(App.java:260)
at org.owasp.dependencycheck.App.run(App.java:192)
at org.owasp.dependencycheck.App.main(App.java:87)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:327)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:315)
... 7 common frames omitted

Experiencing this issue too, posting to stay in the loop of updates

Folks, a whole lot of ‘me too’ without additional information isn’t really helpful. If there are server issues on NIST NVD side, it will affect all ODC variants in similar ways with 503s in the error messages.
Stay on 8.x until the server issues are resolved or suggested mitigations are discovered.
There’s a subscribe button if you want to see updates on an GitHub issue, no need to post messages.

We are also getting the same error, we are using the dependency check in our azure devops pipeline via azure devops extension. https://marketplace.visualstudio.com/items?itemName=dependency-check.dependencycheck
task:
  - task: dependency-check-build-task@6
    inputs:
      projectName: $(projectname)
      scanPath: '$(Build.SourcesDirectory)'
      format: 'JSON, JUNIT'
      reportsDirectory: '$(Agent.TempDirectory)/dependency-scan-results'
      reportFilename: 'dependency-check-report'
      additionalArguments: '--nvdApiKey $(NVD-API-KEY)'

error:
[ERROR] Error updating the NVD Data org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:336) at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110) at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:902) at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:707) at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:633) at org.owasp.dependencycheck.App.runScan(App.java:260) at org.owasp.dependencycheck.App.run(App.java:192) at org.owasp.dependencycheck.App.main(App.java:87) Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 503 at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:327) at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:315) ... 7 common frames omitted

I also have the same problem using the task for Azure Devops.

@Laurens-makel - there is no need to post to subscribe and get updates on an issue. On the right side of the issue screen there is a Notifications option with a subscribe/unsubscribe button.

@jeremylong could you upload your local cache somewhere?  it would help me, and probably others if we just have to download the diff to update our local databases

I was just wondering: since the old download from NVD is still working (for now, I know about 12/15), wouldn't it be possible to bundle these files up in a similar fashion to what the vulnz project is doing? Or are the files generated by vulnz different from those downloaded from the old location?
If so, it's quite easy to script something and use the --nvdDatafeedUrl option until things are working as they should again...

@malice00 its not that easy. The JSON format changed. I will be publishing an updated version of ODC that most people should be able to use this weekend.

@jeremylong Ah, too bad, would've been an easy workaround and would've perhaps gotten rid of some load on NVD in the process. I guess we'll have to wait on your fix.

With #6136 I've been able to successfully update the local database. However, it did take ~30 minutes.

Works for me with
mvn -DnvdApiDelay=128000 ...

Works for me with
mvn -DnvdApiDelay=128000 ...

I think it's entirely luck/timing. I managed to get a run completed a few hours ago with the default delays.

Works for me with
mvn -DnvdApiDelay=128000 ...

Two minutes between requests is pretty slow though.

Works for me with
mvn -DnvdApiDelay=128000 ...

Two minutes between requests is pretty slow though.

With
mvn -DnvdApiDelay=64000 ...
it hasn't work. Than I increased it. but I don't know how long it needed.

@somera you don't need to increase the delay - that won't really help. The issue is that a retry is needed - which will be in 9.0.1.

Also - due to an unfortunate issue with H2, if anyone has succesfully created a db with 9.0.0 - it will likely need to be re-created with 9.0.1. I should be able to finish development and testing tomorrow morning.

9.0.1 was just released. Due to an unfortunate issue with H2 and the gradle plugin - we had to revert the upgrade of H2. This means that anyone that successfully created an H2 database with 9.0.0 will likely need to purge and recreate the database with 9.0.1. The good news is that 9.0.1 now has retry logic built in and we've been able to successfully download the entire dataset from the NVD API.
Notes:

users likely do not need to increase the delay
if you are behind a proxy and by default the proxy configuration is not working - please try setting the default Java proxy configuration using JAVA_OPTS (see https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html)

https.proxyHost
https.proxyPort
https.proxyUser
https.proxyPassword
http.nonProxyHosts

I'm leaving this open until a few users confirm that things are working with 9.0.1.

Works for me
[INFO] Checking for updates
[INFO] NVD API has 171.546 records in this update
[INFO] Downloaded 10.000/171.546 (6%)
[INFO] Downloaded 20.000/171.546 (12%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[INFO] Downloaded 30.000/171.546 (17%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[INFO] Downloaded 40.000/171.546 (23%)
[INFO] Downloaded 50.000/171.546 (29%)
[INFO] Downloaded 60.000/171.546 (35%)
[INFO] Downloaded 70.000/171.546 (41%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[INFO] Downloaded 80.000/171.546 (47%)
[INFO] Downloaded 90.000/171.546 (52%)
[INFO] Downloaded 100.000/171.546 (58%)
[INFO] Downloaded 110.000/171.546 (64%)
[INFO] Downloaded 120.000/171.546 (70%)
[INFO] Downloaded 130.000/171.546 (76%)
[INFO] Downloaded 140.000/171.546 (82%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[INFO] Downloaded 150.000/171.546 (87%)
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 5 time
[WARNING] NVD API request failures are occurring; retrying request for the 6 time
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[INFO] Downloaded 160.000/171.546 (93%)
[WARNING] NVD API request failures are occurring; retrying request for the 7 time
[INFO] Downloaded 170.000/171.546 (99%)

@jeremylong Thx!!!

But I get this errror:
mvn org.owasp:dependency-check-maven:aggregate

[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (1 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.xml
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.html
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.json
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.csv
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.sarif
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-jenkins.html
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-junit.xml
[INFO] Writing report to: D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-gitlab.json
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  10.547 s
[INFO] Finished at: 2023-11-26T14:44:43+01:00
[INFO] ------------------------------------------------------------------------
Exception in thread "Thread-1" java.lang.NoClassDefFoundError: org/apache/commons/jcs3/engine/CacheStatus
        at org.apache.commons.jcs3.auxiliary.disk.AbstractDiskCache.getStatus(AbstractDiskCache.java:493)
        at org.apache.commons.jcs3.engine.control.CompositeCache.dispose(CompositeCache.java:1232)
        at org.apache.commons.jcs3.engine.control.CompositeCacheManager.freeCache(CompositeCacheManager.java:580)
        at org.apache.commons.jcs3.engine.control.CompositeCacheManager.freeCache(CompositeCacheManager.java:567)
        at java.base/java.util.concurrent.ConcurrentHashMap$KeySetView.forEach(ConcurrentHashMap.java:4706)
        at org.apache.commons.jcs3.engine.control.CompositeCacheManager.shutDown(CompositeCacheManager.java:620)
        at org.apache.commons.jcs3.engine.control.CompositeCacheManager.lambda$initialize$0(CompositeCacheManager.java:248)
        at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.ClassNotFoundException: org.apache.commons.jcs3.engine.CacheStatus
        at org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass(SelfFirstStrategy.java:50)
        at org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass(ClassRealm.java:271)
        at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass(ClassRealm.java:247)
        at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass(ClassRealm.java:239)
        ... 8 more

Both vulnz for caching and the maven-plugin are working for me. I can live
with the stacktrace. :-)
On Sun, Nov 26, 2023 at 3:28 PM mastermc0 @.***> wrote:

Took 42 minutes but works for me as part of an Azure DevOps pipeline.On
Nov 26, 2023, at 13:46, somera @.***> wrote:
But I get this errror:
mvn org.owasp:dependency-check-maven:aggregate
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (1 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.xml
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.html
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.json
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.csv
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-report.sarif
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-jenkins.html
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-junit.xml
[INFO] Writing report to:
D:\projects\privat\polonium\raspi_mail_service\target\dependency-check-gitlab.json
[INFO]
[INFO] BUILD SUCCESS
[INFO]
[INFO] Total time: 10.547 s
[INFO] Finished at: 2023-11-26T14:44:43+01:00
[INFO]
Exception in thread "Thread-1" java.lang.NoClassDefFoundError:
org/apache/commons/jcs3/engine/CacheStatus
at
org.apache.commons.jcs3.auxiliary.disk.AbstractDiskCache.getStatus(AbstractDiskCache.java:493)
at
org.apache.commons.jcs3.engine.control.CompositeCache.dispose(CompositeCache.java:1232)
at
org.apache.commons.jcs3.engine.control.CompositeCacheManager.freeCache(CompositeCacheManager.java:580)
at
org.apache.commons.jcs3.engine.control.CompositeCacheManager.freeCache(CompositeCacheManager.java:567)
at
java.base/java.util.concurrent.ConcurrentHashMap$KeySetView.forEach(ConcurrentHashMap.java:4706)
at
org.apache.commons.jcs3.engine.control.CompositeCacheManager.shutDown(CompositeCacheManager.java:620)
at
org.apache.commons.jcs3.engine.control.CompositeCacheManager.lambda$initialize$0(CompositeCacheManager.java:248)
at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.ClassNotFoundException:
org.apache.commons.jcs3.engine.CacheStatus
at
org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass(SelfFirstStrategy.java:50)
at
org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass(ClassRealm.java:271)
at
org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass(ClassRealm.java:247)
at
org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass(ClassRealm.java:239)
... 8 more
—Reply to this email directly, view it on GitHub, or unsubscribe.You are
receiving this because you are subscribed to this thread.Message ID:
@.***>
—
Reply to this email directly, view it on GitHub
https://github.com/jeremylong/DependencyCheck/issues/6107#issuecomment-1826798971,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ADC7EIMAJQMWVTHLAM46PSDYGNGZJAVCNFSM6AAAAAA7WSFDWSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMRWG44TQOJXGE
.
You are receiving this because you were mentioned.Message ID:
@.***>

9.0.1 is not available yet in Jenkins plugin. shall we reinstall the plugin ?

Thanks - I'll close this issue. The stack trace on CacheStatus is being tracked here: https://github.com/jeremylong/DependencyCheck/issues/6141

Hi @jeremylong ,
Sorry, if I re-use this closed issue, but it's not working for me after multiple times tried:
 Configure project :
The 'sonarqube' task depends on compile tasks. This behavior is now deprecated and will be removed in version 5.x. To avoid implicit compilation, set property 'sonar.gradle.skipCompile' to 'true' and make sure your project is compiled, before analysis has started.
The 'sonar' task depends on compile tasks. This behavior is now deprecated and will be removed in version 5.x. To avoid implicit compilation, set property 'sonar.gradle.skipCompile' to 'true' and make sure your project is compiled, before analysis has started.

> Task :dependencyCheckAnalyze
Verifying dependencies for project affiliate-event-consumer
Checking for updates and analyzing dependencies for vulnerabilities

NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 8 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 8 time
NVD API request failures are occurring; retrying request for the 8 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 6 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 7 time
NVD API request failures are occurring; retrying request for the 5 time
NVD API request failures are occurring; retrying request for the 7 time
Task java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask@59a69ef5[Not completed, task = java.util.concurrent.Executors$RunnableAdapter@1b0d317b[Wrapped task = org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$ScheduledRequestExecution@4b366d2a]] rejected from java.util.concurrent.ScheduledThreadPoolExecutor@6e080aea[Shutting down, pool size = 1, active threads = 0, queued tasks = 0, completed tasks = 30]
java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask@59a69ef5[Not completed, task = java.util.concurrent.Executors$RunnableAdapter@1b0d317b[Wrapped task = org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$ScheduledRequestExecution@4b366d2a]] rejected from java.util.concurrent.ScheduledThreadPoolExecutor@6e080aea[Shutting down, pool size = 1, active threads = 0, queued tasks = 0, completed tasks = 30]
        at java.base/java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(ThreadPoolExecutor.java:2065)
        at java.base/java.util.concurrent.ThreadPoolExecutor.reject(ThreadPoolExecutor.java:833)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.delayedExecute(ScheduledThreadPoolExecutor.java:340)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.schedule(ScheduledThreadPoolExecutor.java:562)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.execute(ScheduledThreadPoolExecutor.java:705)
        at java.base/java.util.concurrent.Executors$DelegatedExecutorService.execute(Executors.java:721)
        at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient.executeScheduled(InternalAbstractHttpAsyncClient.java:361)
        at org.apache.hc.client5.http.impl.async.AsyncHttpRequestRetryExec$1.failed(AsyncHttpRequestRetryExec.java:164)
        at org.apache.hc.client5.http.impl.async.AsyncProtocolExec$1.failed(AsyncProtocolExec.java:295)
        at org.apache.hc.client5.http.impl.async.HttpAsyncMainClientExec$1.failed(HttpAsyncMainClientExec.java:131)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamHandler.failed(ClientHttp1StreamHandler.java:285)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamDuplexer.disconnected(ClientHttp1StreamDuplexer.java:220)
        at org.apache.hc.core5.http.impl.nio.AbstractHttp1StreamDuplexer.onDisconnect(AbstractHttp1StreamDuplexer.java:409)
        at org.apache.hc.core5.http.impl.nio.AbstractHttp1IOEventHandler.disconnected(AbstractHttp1IOEventHandler.java:95)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1IOEventHandler.disconnected(ClientHttp1IOEventHandler.java:41)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession$1.disconnected(SSLIOSession.java:247)
        at org.apache.hc.core5.reactor.InternalDataChannel.disconnected(InternalDataChannel.java:204)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.processClosedSessions(SingleCoreIOReactor.java:231)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.doTerminate(SingleCoreIOReactor.java:106)
        at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute(AbstractSingleCoreIOReactor.java:93)
        at org.apache.hc.core5.reactor.IOReactorWorker.run(IOReactorWorker.java:44)
        at java.base/java.lang.Thread.run(Thread.java:833)
NVD API request failures are occurring; retrying request for the 6 time
Task java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask@19f04f93[Not completed, task = java.util.concurrent.Executors$RunnableAdapter@7f5e1845[Wrapped task = org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$ScheduledRequestExecution@793c2e66]] rejected from java.util.concurrent.ScheduledThreadPoolExecutor@35a251dd[Shutting down, pool size = 1, active threads = 0, queued tasks = 0, completed tasks = 32]
java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask@19f04f93[Not completed, task = java.util.concurrent.Executors$RunnableAdapter@7f5e1845[Wrapped task = org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$ScheduledRequestExecution@793c2e66]] rejected from java.util.concurrent.ScheduledThreadPoolExecutor@35a251dd[Shutting down, pool size = 1, active threads = 0, queued tasks = 0, completed tasks = 32]
        at java.base/java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(ThreadPoolExecutor.java:2065)
        at java.base/java.util.concurrent.ThreadPoolExecutor.reject(ThreadPoolExecutor.java:833)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.delayedExecute(ScheduledThreadPoolExecutor.java:340)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.schedule(ScheduledThreadPoolExecutor.java:562)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.execute(ScheduledThreadPoolExecutor.java:705)
        at java.base/java.util.concurrent.Executors$DelegatedExecutorService.execute(Executors.java:721)
        at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient.executeScheduled(InternalAbstractHttpAsyncClient.java:361)
        at org.apache.hc.client5.http.impl.async.AsyncHttpRequestRetryExec$1.failed(AsyncHttpRequestRetryExec.java:164)
        at org.apache.hc.client5.http.impl.async.AsyncProtocolExec$1.failed(AsyncProtocolExec.java:295)
        at org.apache.hc.client5.http.impl.async.HttpAsyncMainClientExec$1.failed(HttpAsyncMainClientExec.java:131)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamHandler.failed(ClientHttp1StreamHandler.java:285)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamDuplexer.disconnected(ClientHttp1StreamDuplexer.java:220)
        at org.apache.hc.core5.http.impl.nio.AbstractHttp1StreamDuplexer.onDisconnect(AbstractHttp1StreamDuplexer.java:409)
        at org.apache.hc.core5.http.impl.nio.AbstractHttp1IOEventHandler.disconnected(AbstractHttp1IOEventHandler.java:95)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1IOEventHandler.disconnected(ClientHttp1IOEventHandler.java:41)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession$1.disconnected(SSLIOSession.java:247)
        at org.apache.hc.core5.reactor.InternalDataChannel.disconnected(InternalDataChannel.java:204)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.processClosedSessions(SingleCoreIOReactor.java:231)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.doTerminate(SingleCoreIOReactor.java:106)
        at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute(AbstractSingleCoreIOReactor.java:93)
        at org.apache.hc.core5.reactor.IOReactorWorker.run(IOReactorWorker.java:44)
        at java.base/java.lang.Thread.run(Thread.java:833)
NVD API request failures are occurring; retrying request for the 6 time
Task java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask@20d6b436[Not completed, task = java.util.concurrent.Executors$RunnableAdapter@7ac2ada1[Wrapped task = org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$ScheduledRequestExecution@733b84d8]] rejected from java.util.concurrent.ScheduledThreadPoolExecutor@66cff16[Shutting down, pool size = 1, active threads = 0, queued tasks = 0, completed tasks = 38]
java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask@20d6b436[Not completed, task = java.util.concurrent.Executors$RunnableAdapter@7ac2ada1[Wrapped task = org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient$ScheduledRequestExecution@733b84d8]] rejected from java.util.concurrent.ScheduledThreadPoolExecutor@66cff16[Shutting down, pool size = 1, active threads = 0, queued tasks = 0, completed tasks = 38]
        at java.base/java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(ThreadPoolExecutor.java:2065)
        at java.base/java.util.concurrent.ThreadPoolExecutor.reject(ThreadPoolExecutor.java:833)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.delayedExecute(ScheduledThreadPoolExecutor.java:340)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.schedule(ScheduledThreadPoolExecutor.java:562)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor.execute(ScheduledThreadPoolExecutor.java:705)
        at java.base/java.util.concurrent.Executors$DelegatedExecutorService.execute(Executors.java:721)
        at org.apache.hc.client5.http.impl.async.InternalAbstractHttpAsyncClient.executeScheduled(InternalAbstractHttpAsyncClient.java:361)
        at org.apache.hc.client5.http.impl.async.AsyncHttpRequestRetryExec$1.failed(AsyncHttpRequestRetryExec.java:164)
        at org.apache.hc.client5.http.impl.async.AsyncProtocolExec$1.failed(AsyncProtocolExec.java:295)
        at org.apache.hc.client5.http.impl.async.HttpAsyncMainClientExec$1.failed(HttpAsyncMainClientExec.java:131)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamHandler.failed(ClientHttp1StreamHandler.java:285)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1StreamDuplexer.disconnected(ClientHttp1StreamDuplexer.java:220)
        at org.apache.hc.core5.http.impl.nio.AbstractHttp1StreamDuplexer.onDisconnect(AbstractHttp1StreamDuplexer.java:409)
        at org.apache.hc.core5.http.impl.nio.AbstractHttp1IOEventHandler.disconnected(AbstractHttp1IOEventHandler.java:95)
        at org.apache.hc.core5.http.impl.nio.ClientHttp1IOEventHandler.disconnected(ClientHttp1IOEventHandler.java:41)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession$1.disconnected(SSLIOSession.java:247)
        at org.apache.hc.core5.reactor.InternalDataChannel.disconnected(InternalDataChannel.java:204)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.processClosedSessions(SingleCoreIOReactor.java:231)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.doTerminate(SingleCoreIOReactor.java:106)
        at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute(AbstractSingleCoreIOReactor.java:93)
        at org.apache.hc.core5.reactor.IOReactorWorker.run(IOReactorWorker.java:44)
        at java.base/java.lang.Thread.run(Thread.java:833)

> Task :dependencyCheckAnalyze
Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:338)
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110)
        at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:904)
        at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:709)
        at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:635)
        at org.owasp.dependencycheck.gradle.tasks.AbstractAnalyze.analyze(AbstractAnalyze.groovy:100)
        at java.base@<IP_ADDRESS>/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base@<IP_ADDRESS>/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base@<IP_ADDRESS>/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base@<IP_ADDRESS>/java.lang.reflect.Method.invoke(Method.java:568)
        at org.gradle.internal.reflect.JavaMethod.invoke(JavaMethod.java:125)
        at org.gradle.api.internal.project.taskfactory.StandardTaskAction.doExecute(StandardTaskAction.java:58)
        at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:51)
        at org.gradle.api.internal.project.taskfactory.StandardTaskAction.execute(StandardTaskAction.java:29)
        at org.gradle.api.internal.tasks.execution.TaskExecution$3.run(TaskExecution.java:248)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:29)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute(DefaultBuildOperationRunner.java:26)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:157)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.run(DefaultBuildOperationRunner.java:47)
        at org.gradle.internal.operations.DefaultBuildOperationExecutor.run(DefaultBuildOperationExecutor.java:73)
        at org.gradle.api.internal.tasks.execution.TaskExecution.executeAction(TaskExecution.java:233)
        at org.gradle.api.internal.tasks.execution.TaskExecution.executeActions(TaskExecution.java:216)
        at org.gradle.api.internal.tasks.execution.TaskExecution.executeWithPreviousOutputFiles(TaskExecution.java:199)
        at org.gradle.api.internal.tasks.execution.TaskExecution.execute(TaskExecution.java:166)
        at org.gradle.internal.execution.steps.ExecuteStep.executeInternal(ExecuteStep.java:105)
        at org.gradle.internal.execution.steps.ExecuteStep.access$000(ExecuteStep.java:44)
        at org.gradle.internal.execution.steps.ExecuteStep$1.call(ExecuteStep.java:59)
        at org.gradle.internal.execution.steps.ExecuteStep$1.call(ExecuteStep.java:56)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:204)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:199)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:157)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.call(DefaultBuildOperationRunner.java:53)
        at org.gradle.internal.operations.DefaultBuildOperationExecutor.call(DefaultBuildOperationExecutor.java:78)
        at org.gradle.internal.execution.steps.ExecuteStep.execute(ExecuteStep.java:56)
        at org.gradle.internal.execution.steps.ExecuteStep.execute(ExecuteStep.java:44)
        at org.gradle.internal.execution.steps.RemovePreviousOutputsStep.execute(RemovePreviousOutputsStep.java:67)
        at org.gradle.internal.execution.steps.RemovePreviousOutputsStep.execute(RemovePreviousOutputsStep.java:37)
        at org.gradle.internal.execution.steps.CancelExecutionStep.execute(CancelExecutionStep.java:41)
        at org.gradle.internal.execution.steps.TimeoutStep.executeWithoutTimeout(TimeoutStep.java:74)
        at org.gradle.internal.execution.steps.TimeoutStep.execute(TimeoutStep.java:55)
        at org.gradle.internal.execution.steps.CreateOutputsStep.execute(CreateOutputsStep.java:50)
        at org.gradle.internal.execution.steps.CreateOutputsStep.execute(CreateOutputsStep.java:28)
        at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.executeDelegateBroadcastingChanges(CaptureStateAfterExecutionStep.java:100)
        at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.execute(CaptureStateAfterExecutionStep.java:72)
        at org.gradle.internal.execution.steps.CaptureStateAfterExecutionStep.execute(CaptureStateAfterExecutionStep.java:50)
        at org.gradle.internal.execution.steps.ResolveInputChangesStep.execute(ResolveInputChangesStep.java:40)
        at org.gradle.internal.execution.steps.ResolveInputChangesStep.execute(ResolveInputChangesStep.java:29)
        at org.gradle.internal.execution.steps.BuildCacheStep.executeWithoutCache(BuildCacheStep.java:179)
        at org.gradle.internal.execution.steps.BuildCacheStep.lambda$execute$1(BuildCacheStep.java:70)
        at org.gradle.internal.Either$Right.fold(Either.java:175)
        at org.gradle.internal.execution.caching.CachingState.fold(CachingState.java:59)
        at org.gradle.internal.execution.steps.BuildCacheStep.execute(BuildCacheStep.java:68)
        at org.gradle.internal.execution.steps.BuildCacheStep.execute(BuildCacheStep.java:46)
        at org.gradle.internal.execution.steps.StoreExecutionStateStep.execute(StoreExecutionStateStep.java:36)
        at org.gradle.internal.execution.steps.StoreExecutionStateStep.execute(StoreExecutionStateStep.java:25)
        at org.gradle.internal.execution.steps.RecordOutputsStep.execute(RecordOutputsStep.java:36)
        at org.gradle.internal.execution.steps.RecordOutputsStep.execute(RecordOutputsStep.java:22)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.executeBecause(SkipUpToDateStep.java:91)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.lambda$execute$2(SkipUpToDateStep.java:55)
        at java.base@<IP_ADDRESS>/java.util.Optional.orElseGet(Optional.java:364)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.execute(SkipUpToDateStep.java:55)
        at org.gradle.internal.execution.steps.SkipUpToDateStep.execute(SkipUpToDateStep.java:37)
        at org.gradle.internal.execution.steps.ResolveChangesStep.execute(ResolveChangesStep.java:65)
        at org.gradle.internal.execution.steps.ResolveChangesStep.execute(ResolveChangesStep.java:36)
        at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsFinishedStep.execute(MarkSnapshottingInputsFinishedStep.java:37)
        at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsFinishedStep.execute(MarkSnapshottingInputsFinishedStep.java:27)
        at org.gradle.internal.execution.steps.ResolveCachingStateStep.execute(ResolveCachingStateStep.java:77)
        at org.gradle.internal.execution.steps.ResolveCachingStateStep.execute(ResolveCachingStateStep.java:38)
        at org.gradle.internal.execution.steps.ValidateStep.execute(ValidateStep.java:108)
        at org.gradle.internal.execution.steps.ValidateStep.execute(ValidateStep.java:55)
        at org.gradle.internal.execution.steps.CaptureStateBeforeExecutionStep.execute(CaptureStateBeforeExecutionStep.java:71)
        at org.gradle.internal.execution.steps.CaptureStateBeforeExecutionStep.execute(CaptureStateBeforeExecutionStep.java:45)
        at org.gradle.internal.execution.steps.SkipEmptyWorkStep.executeWithNonEmptySources(SkipEmptyWorkStep.java:177)
        at org.gradle.internal.execution.steps.SkipEmptyWorkStep.execute(SkipEmptyWorkStep.java:81)
        at org.gradle.internal.execution.steps.SkipEmptyWorkStep.execute(SkipEmptyWorkStep.java:53)
        at org.gradle.internal.execution.steps.RemoveUntrackedExecutionStateStep.execute(RemoveUntrackedExecutionStateStep.java:32)
        at org.gradle.internal.execution.steps.RemoveUntrackedExecutionStateStep.execute(RemoveUntrackedExecutionStateStep.java:21)
        at org.gradle.internal.execution.steps.legacy.MarkSnapshottingInputsStartedStep.execute(MarkSnapshottingInputsStartedStep.java:38)
        at org.gradle.internal.execution.steps.LoadPreviousExecutionStateStep.execute(LoadPreviousExecutionStateStep.java:36)
        at org.gradle.internal.execution.steps.LoadPreviousExecutionStateStep.execute(LoadPreviousExecutionStateStep.java:23)
        at org.gradle.internal.execution.steps.CleanupStaleOutputsStep.execute(CleanupStaleOutputsStep.java:75)
        at org.gradle.internal.execution.steps.CleanupStaleOutputsStep.execute(CleanupStaleOutputsStep.java:41)
        at org.gradle.internal.execution.steps.ExecuteWorkBuildOperationFiringStep.lambda$execute$2(ExecuteWorkBuildOperationFiringStep.java:66)
        at java.base@<IP_ADDRESS>/java.util.Optional.orElseGet(Optional.java:364)
        at org.gradle.internal.execution.steps.ExecuteWorkBuildOperationFiringStep.execute(ExecuteWorkBuildOperationFiringStep.java:66)
        at org.gradle.internal.execution.steps.ExecuteWorkBuildOperationFiringStep.execute(ExecuteWorkBuildOperationFiringStep.java:38)
        at org.gradle.internal.execution.steps.AssignWorkspaceStep.lambda$execute$0(AssignWorkspaceStep.java:32)
        at org.gradle.api.internal.tasks.execution.TaskExecution$4.withWorkspace(TaskExecution.java:293)
        at org.gradle.internal.execution.steps.AssignWorkspaceStep.execute(AssignWorkspaceStep.java:30)
        at org.gradle.internal.execution.steps.AssignWorkspaceStep.execute(AssignWorkspaceStep.java:21)
        at org.gradle.internal.execution.steps.IdentityCacheStep.execute(IdentityCacheStep.java:37)
        at org.gradle.internal.execution.steps.IdentityCacheStep.execute(IdentityCacheStep.java:27)
        at org.gradle.internal.execution.steps.IdentifyStep.execute(IdentifyStep.java:47)
        at org.gradle.internal.execution.steps.IdentifyStep.execute(IdentifyStep.java:34)
        at org.gradle.internal.execution.impl.DefaultExecutionEngine$1.execute(DefaultExecutionEngine.java:64)
        at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.executeIfValid(ExecuteActionsTaskExecuter.java:145)
        at org.gradle.api.internal.tasks.execution.ExecuteActionsTaskExecuter.execute(ExecuteActionsTaskExecuter.java:134)
        at org.gradle.api.internal.tasks.execution.FinalizePropertiesTaskExecuter.execute(FinalizePropertiesTaskExecuter.java:46)
        at org.gradle.api.internal.tasks.execution.ResolveTaskExecutionModeExecuter.execute(ResolveTaskExecutionModeExecuter.java:51)
        at org.gradle.api.internal.tasks.execution.SkipTaskWithNoActionsExecuter.execute(SkipTaskWithNoActionsExecuter.java:57)
        at org.gradle.api.internal.tasks.execution.SkipOnlyIfTaskExecuter.execute(SkipOnlyIfTaskExecuter.java:74)
        at org.gradle.api.internal.tasks.execution.CatchExceptionTaskExecuter.execute(CatchExceptionTaskExecuter.java:36)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.executeTask(EventFiringTaskExecuter.java:77)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.call(EventFiringTaskExecuter.java:55)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter$1.call(EventFiringTaskExecuter.java:52)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:204)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$CallableBuildOperationWorker.execute(DefaultBuildOperationRunner.java:199)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:66)
        at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:157)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.execute(DefaultBuildOperationRunner.java:59)
        at org.gradle.internal.operations.DefaultBuildOperationRunner.call(DefaultBuildOperationRunner.java:53)
        at org.gradle.internal.operations.DefaultBuildOperationExecutor.call(DefaultBuildOperationExecutor.java:78)
        at org.gradle.api.internal.tasks.execution.EventFiringTaskExecuter.execute(EventFiringTaskExecuter.java:52)
        at org.gradle.execution.plan.LocalTaskNodeExecutor.execute(LocalTaskNodeExecutor.java:42)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$InvokeNodeExecutorsAction.execute(DefaultTaskExecutionGraph.java:331)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$InvokeNodeExecutorsAction.execute(DefaultTaskExecutionGraph.java:318)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.lambda$execute$0(DefaultTaskExecutionGraph.java:314)
        at org.gradle.internal.operations.CurrentBuildOperationRef.with(CurrentBuildOperationRef.java:80)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.execute(DefaultTaskExecutionGraph.java:314)
        at org.gradle.execution.taskgraph.DefaultTaskExecutionGraph$BuildOperationAwareExecutionAction.execute(DefaultTaskExecutionGraph.java:303)
        at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.execute(DefaultPlanExecutor.java:463)
        at org.gradle.execution.plan.DefaultPlanExecutor$ExecutorWorker.run(DefaultPlanExecutor.java:380)
        at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:64)
        at org.gradle.internal.concurrent.AbstractManagedExecutor$1.run(AbstractManagedExecutor.java:47)
        at java.base@<IP_ADDRESS>/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base@<IP_ADDRESS>/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base@<IP_ADDRESS>/java.lang.Thread.run(Thread.java:833)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 504
        at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:346)
        at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:317)
        ... 133 more
Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
Unable to continue dependency-check analysis.

> Task :dependencyCheckAnalyze FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':dependencyCheckAnalyze'.
> Analysis failed.

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 39m 47s
1 actionable task: 1 executed

I saw the retry it's works as expected, but I'm getting 504 status code and it didn't do any retry after that 😞

Due to the way common API gateways behave, generally I would say one should retry on all 5xx errors (9ther arguably than 500) - but especially 502 (bad gateway) and 504 (gateway timeout). Both tend to indicate ephemeral problems.
Currently the code only does 429 and 503 I believe.

Fails with 9.0.1 after 20 minutes:
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 504
    at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:346)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:317)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:110)

I receive the same Issue linke @nico-arianto

Hello everyone,
issue still occurs:
08:50:01 [ERROR] Failed to execute goal org.owasp:dependency-check-maven:9.0.1:aggregate (default-cli) on project xxx: Fatal exception(s) analyzing XXX: One or more exceptions occurred during analysis:
08:50:01 [ERROR] 	UpdateException: Error updating the NVD Data
08:50:01 [ERROR] 		caused by NvdApiException: NVD Returned Status Code: 503
08:50:01 [ERROR] 	NoDataException: No documents exist

Thanks

I am getting below error while using Azure devops extension task[https://marketplace.visualstudio.com/items?itemName=dependency-check.dependencycheck]

[WARN] NVD API request failures are occurring; retrying request for the 5 time
[INFO] NVD API has 171,546 records in this update
[WARN] NVD API request failures are occurring; retrying request for the 5 time
[WARN] NVD API request failures are occurring; retrying request for the 5 time
[WARN] NVD API request failures are occurring; retrying request for the 5 time
[WARN] NVD API request failures are occurring; retrying request for the 5 time
[WARN] NVD API request failures are occurring; retrying request for the 6 time
[WARN] NVD API request failures are occurring; retrying request for the 6 time
[WARN] NVD API request failures are occurring; retrying request for the 6 time
[WARN] NVD API request failures are occurring; retrying request for the 6 time
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:338)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:110)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:904)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:709)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:635)
at org.owasp.dependencycheck.App.runScan(App.java:261)
at org.owasp.dependencycheck.App.run(App.java:193)
at org.owasp.dependencycheck.App.main(App.java:88)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 502
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:346)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:317)
... 7 common frames omitted

Can confirm it now retries all the 503s, but then dies on a 504.

I've also seen a failure on a 502.

I am still encountering a 503 error code. Could this issue be related to the API key?

#12 ERROR: process "/bin/sh -c java -jar /tools/vulnz-5.0.2.jar cve --cache  --directory /data" did not complete successfully: exit code: 1

[data 4/4] RUN java -jar /tools/vulnz-5.0.2.jar cve --cache  --directory /data:
147.4 NVD API request failures are occurring; retrying request for the 5 time
148.9 NVD API request failures are occurring; retrying request for the 6 time
150.7 NVD API request failures are occurring; retrying request for the 7 time
152.9 NVD API request failures are occurring; retrying request for the 8 time
155.3 NVD API request failures are occurring; retrying request for the 9 time
158.1 NVD API request failures are occurring; retrying request for the 10 time
161.1 NVD API request failures are occurring; retrying request for the 11 time
161.9 Unable to complete NVD cache update due to error: NVD Returned Status Code: 503
161.9 Completed in 159 seconds
161.9

I am still encountering a 503 error code. Could this issue be related to the API key?

[data 4/4] RUN java -jar /tools/vulnz-5.0.2.jar cve --cache --directory /data:
147.4 NVD API request failures are occurring; retrying request for the 5 time
148.9 NVD API request failures are occurring; retrying request for the 6 time
150.7 NVD API request failures are occurring; retrying request for the 7 time
152.9 NVD API request failures are occurring; retrying request for the 8 time
155.3 NVD API request failures are occurring; retrying request for the 9 time
158.1 NVD API request failures are occurring; retrying request for the 10 time
161.1 NVD API request failures are occurring; retrying request for the 11 time
161.9 Unable to complete NVD cache update due to error: NVD Returned Status Code: 503
161.9 Completed in 159 seconds
161.9

@jeremylong when are you planning to release the next version?

I also got an API key from NVD but now I'm getting a 404 error. Do we need to do anything special with the GUID key to pass it to --nvdApiKey?

Hi @thisjustin816,
yes you can use --data argument to control cache location.
However, be aware that you can't share Azure DevOps Cache Task data across multiple pipes due to strict scoping.
You can find some links about the topic here...

Hi @thisjustin816,
yes you can use --data argument to control cache location.
However, be aware that you can't share Azure DevOps Cache Task data across multiple pipes due to strict scoping.
You can find some links about the topic here...

Thank you. This won't be an issue because we use one pipeline to run it on all our artifacts.

Just so everyone knows - it appears the NVD has put a temporary block on all requests that use a virtualMatchString of "cpe:2.3:a" - which is what ODC is using. I have a dialog going with maintainers of the API.

Hi @thisjustin816, yes you can use --data argument to control cache location. However, be aware that you can't share Azure DevOps Cache Task data across multiple pipes due to strict scoping. You can find some links about the topic here...

You can share the data using artifacts. One project I'm working on has one pipeline that uses a schedule to update the database, and all build pipelines use that updated database.
The update pipeline ends with this:
- publish: '$(Pipeline.Workspace)/dependency-check-data'
  artifact: owasp-dependency-check-data

The build pipelines download this before the actual build starts:
- task: DownloadPipelineArtifact@2
  inputs:
    source: specific
    project: <project with update pipeline>
    pipeline: <id of update pipeline>
    runVersion: latest
    artifact: owasp-dependency-check-data
    path: '$(Pipeline.Workspace)/dependency-check-data'

They then combine the --data option with the --noupdate option to use this pre-updated database.

🤞 that results in them continuing the significantly more efficient data downloads

They also seems to have cloased th API Key deliverance.

@jeremylong Thx for your work! Do you have any new information about the usability of the API?
Currently the new way via the API isnt usable isnt it?

@Maxouwell I have just generated an API key, it seems they have enabled that back. Just FYI

Isn't working for me since two days. I got new API key and I get
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443

@carlmolemans have you done it with 9.0.2? For me it's working #6186

[Update] It's working now for me with 9.0.2 Thanks

It's failing for me again with 9.0.7 in Azure Devops

Isn't working for me since two days. I got new API key and I get
[WARNING] NVD API request failures are occurring; retrying request for the 11 time
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443

We solved it by creating a "common" pipeline for the dependency checks. This runs each night and our builds verify themselves against this cache.

Isn't working for me since two days. I got new API key and I get
[WARNING] NVD API request failures are occurring; retrying request for the 11 time
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443

We solved it by creating a "common" pipeline for the dependency checks. This runs each night and our builds verify themselves against this cache.

Same exact issue for me

Isn't working for me since two days. I got new API key and I get
[WARNING] NVD API request failures are occurring; retrying request for the 11 time
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443
[INFO] Recoverable I/O exception (org.apache.hc.core5.http.ConnectionClosedException) caught when processing request to {s}->https://services.nvd.nist.gov:443

Same for me from a Jenkins instance running on AWS. On my machine works fine though...

I obtained the api key and provided an api key in my pom but still getting the below error
15:44:42  [INFO] Building **** - Parent POMs 3-0-SNAPSHOT                     [1/21]
15:44:42  [INFO] --------------------------------[ pom ]---------------------------------
15:44:42  [INFO]
15:44:42  [INFO] --- dependency-check-maven:9.0.2:purge (default-cli) @ parent-poms ---
15:44:44  [INFO] Database file purged; local copy of the NVD has been removed
15:44:44  [INFO] Cache directory purged
15:44:44  [INFO]
15:44:44  [INFO] --- dependency-check-maven:9.0.2:aggregate (default-cli) @ parent-poms ---
15:44:45  [INFO] Checking for updates
15:44:45  [WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
15:47:06  [INFO] Recoverable I/O exception (org.apache.hc.client5.http.ConnectTimeoutException) caught when processing request to {s}->https://services.nvd.nist.gov:443
15:49:13  [INFO] Recoverable I/O exception (org.apache.hc.client5.http.ConnectTimeoutException) caught when processing request to {s}->https://services.nvd.nist.gov:443
15:51:19  [INFO] Recoverable I/O exception (org.apache.hc.client5.http.ConnectTimeoutException) caught when processing request to {s}->https://services.nvd.nist.gov:443
I had earlier tried with version 9.0.7 and was getting this error
14:33:37  [INFO] --- dependency-check-maven:9.0.7:purge (default-cli) @ parent-poms ---
14:33:42  [INFO] Unable to purge database; the database file does not exist: /apps/jenkins-core-agent/.m2/repository-executor-3/org/owasp/dependency-check-utils/9.0.7/../../dependency-check-data/9.0/odc.mv.db
14:33:42  [INFO]
14:33:42  [INFO] --- dependency-check-maven:9.0.7:aggregate (default-cli) @ parent-poms ---
14:33:43  [INFO] Checking for updates
14:33:43  [WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
14:44:51  [WARNING] NVD API request failures are occurring; retrying request for the 5 time
14:46:58  [WARNING] NVD API request failures are occurring; retrying request for the 6 time
14:49:04  [WARNING] NVD API request failures are occurring; retrying request for the 7 time
14:51:11  [WARNING] NVD API request failures are occurring; retrying request for the 8 time
14:53:32  [WARNING] NVD API request failures are occurring; retrying request for the 9 time
14:55:39  [WARNING] NVD API request failures are occurring; retrying request for the 10 time
14:57:45  [WARNING] NVD API request failures are occurring; retrying request for the 11 time
15:08:39  [WARNING] NVD API request failures are occurring; retrying request for the 5 time
15:11:01  [WARNING] NVD API request failures are occurring; retrying request for the 6 time
15:13:07  [WARNING] NVD API request failures are occurring; retrying request for the 7 time
15:15:13  [WARNING] NVD API request failures are occurring; retrying request for the 8 time
I read a comment on another this thread that said 9.0.2 worked but it doesn't seem to be working for me. Is the issue fixed please @jeremylong ?

@somera @nico-arianto  How long did it take before 9.0.2 worked for you. Did you provide an api key? Please advise. Thanks

@ifyenuoyibo Version 9.0.7 has been released since then, I'd suggest you give that a try: https://github.com/jeremylong/DependencyCheck/blob/main/CHANGELOG.md

The logs state an API key was NOT provided.

@nscuro for me it's working since 9.0.2 and I have an NVD API Key. Current run with 9.0.7:
[INFO] Checking for updates
[INFO] NVD API has 1.405 records in this update
[INFO] Downloaded 1.405/1.405 (100%)
[INFO] Completed processing batch 1/1 (100%) in 2.100ms
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (3502 ms)
[INFO] Check for updates complete (9771 ms)

@ifyenuoyibo I'm using the NVD key and it took me ~30 mins with 9.0.2 to download the database for the 1st time from clean state.

I needed ~45 minutes with 9.0.2 for the first download.

[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=232000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=234000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=236000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=238000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=240000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=242000
[INFO] NVD API has 242,227 records in this update
[DEBUG] Temporary directory is `/tmp/dctempde847f7a-e691-4425-b8ec-a3b09dbb591e`
[DEBUG] Ticket returned At: 18:27:07; count: 3; by 82
[DEBUG] Ticket taken At: 18:27:07; count: 3; by 82
[DEBUG] Requested At: 18:27:07; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=10000
[DEBUG] Ticket returned At: 18:27:07; count: 4; by 83

..............................................................

[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=240000
[DEBUG] Requested At: 18:20:30; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=220000
[DEBUG] Ticket taken At: 18:20:30; count: 50; by 77
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=238000
[DEBUG] Requested At: 18:20:30; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=166000
[DEBUG] Ticket taken At: 18:20:38; count: 50; by 74
[DEBUG] Requested At: 18:20:38; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=222000
[DEBUG] Ticket returned At: 18:20:42; count: 51; by 75
[DEBUG] Rate Limited API call - waiting for 3736ms
[DEBUG] Content-Type Received: application/json
[DEBUG] Ticket taken At: 18:20:46; count: 50
[DEBUG] Requested At: 18:20:46; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=238000
[DEBUG] Ticket returned At: 18:20:49; count: 51; by 75
[DEBUG] Content-Type Received: application/json
[DEBUG] Content-Type Received: application/json
[DEBUG] Content-Type Received: application/json
[DEBUG] Ticket taken At: 18:21:07; count: 50
[DEBUG] Requested At: 18:21:07; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=240000
[DEBUG] Content-Type Received: application/json
[DEBUG] Retrying request 2 time
[DEBUG] Ticket returned At: 18:21:37; count: 51; by 74
[DEBUG] Content-Type Received: application/json
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:389)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
    at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
    at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
    at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1953)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1136)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)

I cant analyze a project after update to 9.0.10. I'm upgrading from 7.4 according to deprecation informed.
After a lot of times trying to analyze, it looks like after 95% always get this error. Other times, before 95%, when Ticket taken At: xxxx reach count: 50.
Actually I have this properties on pom.xml
                    <nvdApiDelay>16000</nvdApiDelay>
                    <nvdMaxRetryCount>20</nvdMaxRetryCount>
                    <nvdValidForHours>8</nvdValidForHours>
                    <connectionTimeout>15000</connectionTimeout>
                    <nvdApiKey>{apiKey}</nvdApiKey>

[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=232000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=234000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=236000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=238000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=240000
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=242000
[INFO] NVD API has 242,227 records in this update
[DEBUG] Temporary directory is `/tmp/dctempde847f7a-e691-4425-b8ec-a3b09dbb591e`
[DEBUG] Ticket returned At: 18:27:07; count: 3; by 82
[DEBUG] Ticket taken At: 18:27:07; count: 3; by 82
[DEBUG] Requested At: 18:27:07; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=10000
[DEBUG] Ticket returned At: 18:27:07; count: 4; by 83

..............................................................

[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=240000
[DEBUG] Requested At: 18:20:30; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=220000
[DEBUG] Ticket taken At: 18:20:30; count: 50; by 77
[DEBUG] requesting URI: https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=238000
[DEBUG] Requested At: 18:20:30; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=166000
[DEBUG] Ticket taken At: 18:20:38; count: 50; by 74
[DEBUG] Requested At: 18:20:38; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=222000
[DEBUG] Ticket returned At: 18:20:42; count: 51; by 75
[DEBUG] Rate Limited API call - waiting for 3736ms
[DEBUG] Content-Type Received: application/json
[DEBUG] Ticket taken At: 18:20:46; count: 50
[DEBUG] Requested At: 18:20:46; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=238000
[DEBUG] Ticket returned At: 18:20:49; count: 51; by 75
[DEBUG] Content-Type Received: application/json
[DEBUG] Content-Type Received: application/json
[DEBUG] Content-Type Received: application/json
[DEBUG] Ticket taken At: 18:21:07; count: 50
[DEBUG] Requested At: 18:21:07; URI: /rest/json/cves/2.0?resultsPerPage=2000&startIndex=240000
[DEBUG] Content-Type Received: application/json
[DEBUG] Retrying request 2 time
[DEBUG] Ticket returned At: 18:21:37; count: 51; by 74
[DEBUG] Content-Type Received: application/json
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:389)
    at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:116)
    at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:906)
    at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:711)
    at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:637)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1953)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1136)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)

I cant analyze a project after update to 9.0.10. I'm upgrading from 7.4 according to deprecation informed.
After a lot of times trying to analyze, it looks like after 95% always get this error. Other times, before 95%, when Ticket taken At: xxxx reach count: 50.
Actually I have this properties on pom.xml
                    <nvdApiDelay>16000</nvdApiDelay>
                    <nvdMaxRetryCount>20</nvdMaxRetryCount>
                    <nvdValidForHours>8</nvdValidForHours>
                    <connectionTimeout>15000</connectionTimeout>
                    <nvdApiKey>{apiKey}</nvdApiKey>

I am seeing the same, as this was working fine yesterday with 9.0.10, I suspect it might be related to something in the NVD data itself?

I am seeing the same, as this was working fine yesterday with 9.0.10, I suspect it might be related to something in the NVD data itself?

From https://nvd.nist.gov/:
NIST is currently working to establish a consortium to address challenges in the NVD program and develop improved tools and methods. You will temporarily see delays in analysis efforts during this transition. We apologize for the inconvenience and ask for your patience as we work to improve the NVD program.

I am seeing the same, as this was working fine yesterday with 9.0.10, I suspect it might be related to something in the NVD data itself?

From https://nvd.nist.gov/:
NIST is currently working to establish a consortium to address challenges in the NVD program and develop improved tools and methods. You will temporarily see delays in analysis efforts during this transition. We apologize for the inconvenience and ask for your patience as we work to improve the NVD program.

It's possible that error is cause by an external server, but, Isn't possible to reuse already downloaded segments?
Each time analyze is executed download starts from 0, it doesn't reuse vulnerabilites downloaded previously. It tooks more than 20/30 minutes each running to get always same error at same percent.
Now i'm running locally, 4 hours at least with a lot of retries, and without download db for first time.