Questions about CVE-2026-33117

[JCushingGrid2020]

I am very sorry if this is the wrong place to post this, but I don't know where else to ask OWASP technical questions. Our organization is using open-source OWASP dependency-check to scan our third-party Java libraries, which are static .jars. I have found a vulnerability that appears to be a false positive, but I cannot seem to solve it without suppressing:

CVE-2026-33117 on Azure SDK jars
CVSS 3.1 base score 9.1, Critical

Standard way to resolve this issue: Upgrade azure-security-keyvault-keys to 4.10.6 or newer when that jar is on the classpath. The problem is, that jar is not on any of our classpaths, and we do not use this library.

What we are doing: Suppressing CVE-2026-33117 on azure-communication-, azure-core-, azure-json-, and azure-identity-.

File pattern: azure-communication-, azure-core-, azure-json-, and azure-identity-.

The CVE is Azure Key Vault Keys, fixed in azure-security-keyvault-keys 4.10.6. That jar is not on any of our classpaths. The NVD CPE microsoft:azure_sdk_for_java is broad, so Dependency-Check attaches the CVE to every Azure SDK jar and then compares unrelated artifact versions to the Key Vault Keys fix line. azure-identity 1.18.7 matches only because its 1.x version is numerically below 4.10.6. The jars are already identified correctly, so a hint cannot retarget the CPE. The suppression is limited to that one CVE and those file names.
Is there a way to remediate this issue without suppressing the warning?

[chadlwilson]

Try searching before posting: #8553 azure identity may be a different, but related issue. #7000

As a general rule, you probably cannot manage vulnerabilities in the real world without managing suppressions, especially with NVD. NVD simply does not manage vuln matching at the granularity you are looking for.

[JCushingGrid2020]

Thank you!