Vulnerable Components in Java Projects – OWASP A06

Direct Answer

“Vulnerable and Outdated Components” is A06 in OWASP Top 10:2021. In the current 2025 release, dependency and build risks are covered more broadly by A03 Software Supply Chain Failures. Manage them with an inventory or SBOM, reproducible dependency management, scanning of direct and transitive components, trusted repositories, build-pipeline protection, and a process that evaluates advisories in the application's actual context. Patch or mitigate based on exploitability and exposure, not a CVSS number alone.

Code Example

<properties>
    <!-- Keep this centrally managed and update it through normal dependency review. -->
    <dependency-check.version>${approved.dependency-check.version}</dependency-check.version>
</properties>
<build>
  <plugins>
    <plugin>
      <groupId>org.owasp</groupId>
      <artifactId>dependency-check-maven</artifactId>
      <version>${dependency-check.version}</version>
      <executions>
        <execution><goals><goal>check</goal></goals></execution>
      </executions>
      <configuration>
        <formats><format>HTML</format><format>JSON</format></formats>
      </configuration>
    </plugin>
  </plugins>
</build>

mvn -ntp dependency:tree
mvn -ntp org.owasp:dependency-check-maven:check

Pin tool versions for reproducible builds, update them deliberately, and triage findings rather than treating one fixed CVSS threshold as the whole policy.

Common Mistakes & Pitfalls

• Set and Forget Dependencies: Adding libraries to pom.xml during initial development and never updating them again—applications run for years on vulnerable dependency versions from 2020.
• Ignoring Transitive Dependencies: Only reviewing direct dependencies in pom.xml while ignoring the 150+ transitive dependencies pulled in automatically—vulnerabilities hide several layers deep.
• Open-Ended Version Ranges: Using version ranges like <version>[5.0,6.0)</version> hoping Maven will auto-update to secure versions—Maven doesn't automatically fetch newer versions, and ranges create unpredictable builds.
• No CI Integration: Running mvn dependency:tree manually once during a security audit instead of integrating vulnerability scanning into every build—by the time you manually check, a zero-day could have been disclosed weeks ago.