[FP]: org.apache.httpcomponents:httpcore 4.4.16 matched to Core 5 CVEs via apache:httpcomponents_core CPE #8653

Package URl

pkg:maven/org.apache.httpcomponents/httpcore@4.4.16

CPE

cpe:2.3:a:apache:httpcomponents_core:4.4.16:::::::*

CVE

No response

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

12.2.2

Description

mvn dependency-check:12.2.2:aggregate reports CVE-2026-54399 and CVE-2026-54428 for httpcore-4.4.16.jar, but those CVEs affect Apache HttpComponents Core 5 (org.apache.httpcomponents.core5:httpcore5 / httpcore5-h2), not the 4.x Maven artifact org.apache.httpcomponents:httpcore