[FP]: CVE-2025-7962 is wrongly reported for angus-activation

[va699]

Package URl

pkg:maven/org.eclipse.angus/angus-activation@2.0.2

CPE

cpe:2.3:a:eclipse:angus_mail:2.0.2:::::::*

CVE

CVE-2025-7962

ODC Integration

{"label" => "Docker"}

ODC Version

12

Description

CVE-2025-7962 is wrongly reported for pkg:maven/org.eclipse.angus/angus-activation@2.0.2 although the vulnerability is on angus-mail package.

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.eclipse.angus</groupId>
   <artifactId>angus-activation</artifactId>
   <version>2.0.2</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8144
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.angus/angus-activation@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:angus_mail</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/19560587330

[chadlwilson]

Please search for existing issues before creating new ones.

This was already fixed in #8310 - ensure your hosted suppressions is enabled and updated.