To scan a Maven project, add an SCA plugin to the build, such as OWASP Dependency-Check, and run it against the resolved dependency tree. Then inspect the tree with the Maven dependency plugin to see where each vulnerable artifact comes from. Plan for some false positives, because matching can rely on name based identifiers.
Definitions
Artifact. A Maven component identified by group, artifact id and version.
Dependency tree. The resolved graph of direct and transitive artifacts after Maven applies its conflict rules.
CPE. A Common Platform Enumeration string, a naming scheme used by the National Vulnerability Database to identify products.
How OWASP Dependency-Check works
The project page says it identifies a project's dependencies and checks them for publicly disclosed vulnerabilities. Analyzers collect pieces of evidence about each dependency and use that evidence to guess its CPE. If a CPE is found, the tool lists the related CVE entries in a report.
It pulls data from NVD feeds hosted by NIST and from several third party sources. It offers a command line tool, a Maven plugin, a Gradle plugin and integrations with common build systems. The first data download can take ten minutes or more. After that, running it at least once every seven days keeps the local data current with a small update.
Steps
- Add the plugin to your pom.xml or run the command line tool against the project.
- Run it and open the generated report.
- List the tree to see why an artifact is present.
- Upgrade the closest parent that removes the vulnerable version.
- Rebuild and re-scan.
mvn org.apache.maven.plugins:maven-dependency-plugin:3.11.0:tree -Dverbose=true -Dincludes="org.apache.*"
The tree goal can filter by group, artifact, type and version with wildcards, show duplicates that conflict resolution removed when verbose is on, and write to a file. Newer plugin versions can also emit JSON.
Approaches compared
| Approach | Strength | Watch out for |
|---|---|---|
| Name based matching (CPE) | Works on jars with little metadata | Can flag the wrong artifact |
| Coordinate based matching (package URL plus advisory ranges) | Precise on ecosystem and version | Needs advisory data in that format |
| Tree inspection | Shows the path | Does not itself check vulnerabilities |
Tips
- Suppress a false positive with a documented reason, not silently.
- Scan the built artifact when you can, because shaded jars hide dependencies from the pom.
- Keep the data cache in CI so scans stay fast.
Try it yourself
Click through it at your own pace, or open it full screen.
Expand the inventory and spot transitive artifacts you never declared.
Quick check
Why does the report flag a library I do not use?
Name based matching can confuse similar product names, or the vulnerable code may sit in a module you never call. Check the advisory before acting.
How often should the Maven scan run?
On every pull request, and on a schedule for code that rarely changes, since new advisories arrive after release.
Safeguard matches Java dependencies from your build files and uses reachability analysis to show which findings your code calls. Try a free scan.
Sources
Last reviewed: 19 October 2026.
