NVD Mirror is constantly throwing expections, but might be working?

[roadSurfer]

I am currently upgrading from 4.10.1 to latest and have gotten as far as 4.11.7, where I have noticed what might be a problem (with my deployment, maybe not with DT).

My NVD settings look like this:

The NVD hadn't been updated since October 2024, an obvious problem, so I removed the "Last Modification" to try and force the NVD to mirror. This is an excerpt from whan I am seeing in the logs.

2025-09-25 08:38:20,259 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2024.json.gz
2025-09-25 08:38:20,595 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #1 in PT1S
2025-09-25 08:38:21,880 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #2 in PT2S
2025-09-25 08:38:24,214 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #3 in PT4S
2025-09-25 08:38:28,494 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #4 in PT8S
2025-09-25 08:38:36,830 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #5 in PT16S
2025-09-25 08:38:40,783 INFO [NistApiMirrorTask] Mirrored 4000/311493 CVEs (1%)
2025-09-25 08:38:53,250 ERROR [NistMirrorTask] Failed after 6 retry attempts
	at org.dependencytrack.tasks.NistMirrorTask.doDownload(NistMirrorTask.java:306)
	at org.dependencytrack.tasks.NistMirrorTask.getAllFiles(NistMirrorTask.java:218)
	at org.dependencytrack.tasks.NistMirrorTask.inform(NistMirrorTask.java:196)
2025-09-25 08:38:53,252 ERROR [NistMirrorTask] Download failed : Retry 'nvd-feeds' has exhausted all attempts (6)
2025-09-25 08:38:53,263 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2024.meta
2025-09-25 08:38:53,595 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #1 in PT1S
2025-09-25 08:38:54,929 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #2 in PT2S
2025-09-25 08:39:18,402 INFO [NistApiMirrorTask] Mirrored 6000/311493 CVEs (1%)
2025-09-25 08:39:52,720 INFO [NistApiMirrorTask] Mirrored 8000/311493 CVEs (2%)
2025-09-25 08:39:56,963 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #3 in PT4S
	at org.dependencytrack.tasks.NistMirrorTask.lambda$doDownload$4(NistMirrorTask.java:306)
	at org.dependencytrack.tasks.NistMirrorTask.doDownload(NistMirrorTask.java:306)
	at org.dependencytrack.tasks.NistMirrorTask.getAllFiles(NistMirrorTask.java:219)
	at org.dependencytrack.tasks.NistMirrorTask.inform(NistMirrorTask.java:196)
2025-09-25 08:40:31,770 INFO [NistApiMirrorTask] Mirrored 10000/311493 CVEs (3%)
2025-09-25 08:41:00,968 WARN [NistMirrorTask] Encountered retryable exception; Will execute retry #4 in PT8S
	at org.dependencytrack.tasks.NistMirrorTask.lambda$doDownload$4(NistMirrorTask.java:306)
	at org.dependencytrack.tasks.NistMirrorTask.doDownload(NistMirrorTask.java:306)
	at org.dependencytrack.tasks.NistMirrorTask.getAllFiles(NistMirrorTask.java:219)
	at org.dependencytrack.tasks.NistMirrorTask.inform(NistMirrorTask.java:196)
2025-09-25 08:41:12,455 INFO [NistApiMirrorTask] Mirrored 12000/311493 CVEs (3%)
2025-09-25 08:41:46,645 INFO [NistApiMirrorTask] Mirrored 14000/311493 CVEs (4%)

It looks like the mirroring is maybe working, but why all the exceptions? I am slightly concerned that, despite having a valid API key etc, we are being blocked for some reason.

[roadSurfer]

Hmm....could this be the switch from the 1.1 to 2.0 feeds and the problem will magically go away once I get upgraded to latest?

[nscuro]

The problem is that you enabled the "Additionally download feeds" option.

The NVD has discontinued the 1.1 feeds entirely. DT v4.13.4 shipped with support for the new 2.0 feeds: https://docs.dependencytrack.org/changelog/#v4-13-4

The mirroring in your case is still able to progress because you toggled "Enable mirroring via API".
In this constellation, feed downloads and mirroring are independent from another, so the feed file downloads failing doesn't interrupt the API mirroring.

I would recommend to disable the "Additionally download feeds" option, or upgrading to 4.13.4 if you rely on feed files being downloaded.

[roadSurfer]

Perfect, I had my suspicions. I aim to hit 4.13.4+ ASAP.

Thanks for the confirmation.