Why CVE Feeds and SCA Tools Can Miss End-of-Life Software

Summary

A sponsored HeroDevs analysis argues that CVE feeds and SCA tools can miss end-of-life dependencies when advisories omit unsupported versions. It cites a Spring Security example and reports 5.4 million EOL versions among 12 million package versions analyzed.

Key points

The article says scanners may not alert on EOL versions omitted from official CVE affected ranges; an absent alert does not establish that a version is safe.
HeroDevs says Spring Security 6.2.x is affected by CVE-2026-22732, although the upstream record does not list it. The article says 6.2.x reached EOL in December 2025 and HeroDevs backported a fix for NES customers.
In analysis of 12 million package versions, HeroDevs reports 5.4 million were EOL; it says endoflife[.]date accounts for about 7,000 versions.
HeroDevs reports that it finds an EOL version needing a patch in about 80% of CVEs disclosed for a supported version.
HeroDevs says it has confirmed more than 81,000 EOL package versions with known CVEs and no available fix, and estimates the broader total could exceed 400,000.
The article cites Sonatype data indicating that 5–15% of components in enterprise dependency graphs are EOL, with transitive dependencies accounting for much of the exposure.

Article Details

Topic: End-of-life open-source software may fall outside CVE investigations and scanner coverage, leaving vulnerabilities and enterprise dependency exposure undetected.