HeroDevs Warns CVE Feeds Can Miss Vulnerabilities in End-of-Life Packages

Summary

A HeroDevs-sponsored analysis says scanners can miss vulnerabilities in end-of-life dependencies when advisories omit unsupported versions. It cites Spring Security 6.2 and software supply-chain data to illustrate the exposure.

Key points

The article says vulnerability advisories may omit end-of-life versions from affected ranges, leaving scanners without an alert for those versions.
HeroDevs says Spring Security 6.2.x is affected by CVE-2026-22732, although the upstream CVE record does not list it; HeroDevs reports backporting a fix for its NES customers.
HeroDevs found 5.4 million end-of-life versions among 12 million package versions it analyzed across major ecosystems.
The article cites Sonatype research estimating that 5–15% of components in enterprise dependency graphs are end-of-life, with transitive dependencies carrying much of the exposure.
HeroDevs says it needs to patch an end-of-life version for about 80% of CVEs disclosed on a supported version.
The article warns that AI-assisted vulnerability discovery could reveal more issues in end-of-life software that maintainers and scanners do not cover.