[FP]: CVE-2025-5222 in org.graalvm.shadowed/icu4j@24.2.2

[AlexanderB-elo]

Package URl

pkg:maven/org.graalvm.shadowed/icu4j@24.2.2

CPE

cpe:2.3:a:icu-project:international_components_for_unicode:24.2.2:::::::*

CVE

CVE-2025-5222

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.3

Description

False positive in graals org.graalvm.shadowed version of unicode international support.

icu4j-24.2.2.jar (pkg:maven/org.graalvm.shadowed/icu4j@24.2.2, cpe:2.3:a:icu-project:international_components_for_unicode:24.2.2:::::::, cpe:2.3:a:unicode:international_components_for_unicode:24.2.2:::::::) : CVE-2025-5222

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.graalvm.shadowed</groupId>
   <artifactId>icu4j</artifactId>
   <version>24.2.2</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7862
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\.shadowed/icu4j@.*$</packageUrl>
   <cpe>cpe:/a:icu-project:international_components_for_unicode</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/16930379300