fix: fix NPE (#6778)

jeremylong · Jul 4, 2024 · 3f0ffa9 · 3f0ffa9
1 parent 9fbb996
commit 3f0ffa9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/CveEcosystemMapper.java b/core/src/main/java/org/owasp/dependencycheck/data/nvd/ecosystem/CveEcosystemMapper.java
@@ -82,10 +82,11 @@ public String getEcosystem(DefCveItem cve) {
      * <code>null</code>
      */
     private boolean hasMultipleVendorProductConfigurations(DefCveItem cve) {
-        if (cve.getCve().getConfigurations() != null) {
+        if (cve.getCve().getConfigurations() != null && !cve.getCve().getConfigurations().isEmpty()) {
             final List<CpeMatch> cpeEntries = cve.getCve().getConfigurations().stream()
                     .map(Config::getNodes)
                     .flatMap(List::stream)
+                    .filter(cpe -> cpe.getCpeMatch() != null)
                     .map(Node::getCpeMatch)
                     .flatMap(List::stream)
                     .filter(match -> match.getCriteria() != null)