Dependency check fails with Error updating the NVD data due to Cannot deserialize value of type java.time.ZonedDateTime from String error

[commadelimited]

Precondition

• I checked the issues list for existing open or closed reports of the same problem.

Describe the bug
When running the mvn dependency-check:aggregate command within any repository, using version 12.2.0 or 12.2.1, I receive the following error:

org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data

Version of dependency-check used
The problem occurs using version 12.2.0 and 12.2.1 of the maven plugin.

Log file
When reporting errors, 99% of the time log file output is required. Please post the log file as a gist and provide a link in the new issue.
https://gist.github.com/commadelimited/1a4dcd5f0c99463fb69f102344a69544

To Reproduce
Steps to reproduce the behavior:

1. Visit a repository containing a pom.xml file which uses wither 12.2.0 or 12.2.1 of the maven dependency check plugin
2. Run mvn dependency-check:aggregate
3. Receive error

Expected behavior
I expect this aggregate check to complete.

Additional context
I was able to run this command just a few hours prior and it finished successfully.
Another coworker on a separate machine, in a different state, is also experiencing the same behavior.

[sleiss]

We have the same issue and it seems to be caused by the NVD API (https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&startIndex=0) returning 9 instead of 6 decimal places for the timestamp property.

[chadlwilson]

NVD have changed something.

Depends on resolving jeremylong/open-vulnerability-clients#106 (assuming they don’t revert the change)

[chadlwilson]

@commadelimited can you do me a favour and update the title to refer to something like

Dependency check fails with Error updating the NVD data due to Cannot deserialize value of type java.time.ZonedDateTime from String error

I don’t have permissions to edit titles, and it might reduce the number of duplicates people are creating, because ODC will be broken when using the NVD API for everyone unless the change is reverted.

Root cause errors look like

ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.1:check (default-cli) on project my-project: Fatal exception(s) analyzing Project: One or more exceptions occurred during analysis:
[ERROR]         UpdateException: Error updating the NVD Data
[ERROR]                 caused by NvdApiException: Failed to parse NVD data
[ERROR]                 caused by InvalidFormatException: Cannot deserialize value of type `java.time.ZonedDateTime` from String "2026-04-15T15:42:08.850326100Z": Failed to deserialize java.time.ZonedDateTime: (java.time.format.DateTimeParseException) Text '2026-04-15T15:42:08.850326100Z' could not be parsed, unparsed text found at index 23
[ERROR]  at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 108] (through reference chain: io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20["timestamp"])
[ERROR]                 caused by DateTimeParseException: Text '2026-04-15T15:42:08.850326100Z' could not be parsed, unparsed text found at index 23
[ERROR]         NoDataException: No documents exist
[ERROR] -> [Help 1]

[commadelimited]

@chadlwilson done.

[chadlwilson]

NVD 2.0 Data Feed workaround

As a workaround, if this is not rolled back upstream, folks needing a short term solution might want to migrate to using the NVD 2.0 data feeds which seem to be OK right now. (#7514)

Important caveat: One concern I have is that according to the dates on https://nvd.nist.gov/vuln/data-feeds the feeds haven’t been updated since 04/14/2026; 8:00:02 PM -0400 whereas it should be every 2 hours. So it may be that NVD broke their own stuff internally too. So the data feeds may not have new CVEs being added or updated either and thus not much better than using a stale cached set of NVD API data with updates disabled.

—-
This is not documented anywhere properly right now, however to do this, you want to set config like the below (Gradle example, equivalent config setting should exist for other integrations)

dependencyCheck {
  nvd.datafeedUrl = 'https://nvd.nist.gov/feeds/json/cve/2.0/nvdcve-2.0-{0}.json.gz'
}

• This bypasses the API completely, which is likely why it is not affected by the API issue above.
• No API key/auth is necessary.
• Good citizens without a external DB will still cache their database or data directory as in https://dependency-check.github.io/DependencyCheck/data/cacheh2.html, or use a caching proxy in front of the NVD downloads.
• I do not know the consequence of switching on top of an existing external or cached or ODC database or data directory cache. I started fresh.

(disclaimer: I also do not know if anyone has done an empirical comparison of ODC database comparing 2.0 data feed data to APi data to ensure it is 100% identical)