javadependency-check/DependencyCheck #8178Not a task: already works

Getting database connection error (NPE in DatabaseManager.getConnection ) while trying to run from Gitlab CICD

envgap__dependency-check__DependencyCheck-8178

Original GitHub issue ↗Dated source checkout ↗Opened 2025-12-05

01 / FAILURE SIGNATURE

As reported upstream

org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error connecting to the database

Not a benchmark task.

The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit: c906505c852cb5db7dab9a93922de12a5ebcd748
Manifest: pom.xml
Reproduce: Awaiting issue-specific recipe
Run under trace: Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

dependency-check/DependencyCheck #8178 · read the original issue

Running dependency check with a NVD Apikey from Gitlab CICD environment is giving the following error without any clear explanation. Version we are using 12.1.9.

This might be because of connection pooling issue while trying to save into the h2 database, but didn't find any option to increase the pool size. Surprisingly it's not getting any error while running from local setup and also able to connect and see the data in the database with userid "dcuser"

6133 [INFO] Downloaded 10,000/320,367 (3%)
24155 [INFO] Downloaded 20,000/320,367 (6%)
33155 [INFO] Downloaded 30,000/320,367 (9%)
44931 [INFO] Downloaded 40,000/320,367 (12%)
59866 [INFO] Downloaded 50,000/320,367 (16%)
66546 [ERROR] Failed to process CVE-2011-4261
org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error connecting to the database
    at org.owasp.dependencycheck.data.nvdcve.DatabaseManager.getConnection (DatabaseManager.java:578)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability (CveDB.java:1168)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:1093)
    at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb (NvdApiProcessor.java:119)
    at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:96)
    at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:40)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)
Caused by: java.sql.SQLException: Data source is closed
    at org.apache.commons.dbcp2.BasicDataSource.createDataSource (BasicDataSource.java:525)
    at org.apache.commons.dbcp2.BasicDataSource.getConnection (BasicDataSource.java:723)
    at org.owasp.dependencycheck.data.nvdcve.DatabaseManager.getConnection (DatabaseManager.java:576)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateOrInsertVulnerability (CveDB.java:1168)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:1093)
    at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb (NvdApiProcessor.java:119)
    at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:96)
    at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call (NvdApiProcessor.java:40)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)

Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched

[]