OWASP Dependency-Check scans dependencies for known CVEs. Learn how this free, open-source SCA tool works, its features, and top alternatives in 2026.
OWASP Dependency-Check is a software composition analysis tool built to answer a simple but important question: does this project use any open-source libraries with publicly known security vulnerabilities?
Rather than analyzing an application's own source code, Dependency-Check inspects the third-party dependencies pulled in through package managers and build tools, matching them against public vulnerability databases so teams can catch known-vulnerable components before they ship.
The tool identifies dependencies and gathers evidence about them, then attempts to map that evidence to Common Platform Enumeration identifiers so it can cross-reference the National Vulnerability Database for matching CVE records, generating a report with CVE IDs, CVSS severity scores, and links to advisories.
It runs as a standalone command-line utility or via build-tool plugins for Maven, Gradle, and Ant, and integrates into CI/CD pipelines including Jenkins, GitHub Actions, and Azure DevOps, with additional ecosystem-specific checks pulled from sources like the NPM Audit API, OSS Index, RetireJS, and Bundler Audit.
Dependency-Check is entirely free and open source under the Apache License 2.0, with no paid tiers, license fees, or usage limits since it runs locally or in a team's own CI infrastructure.
Because it is community-maintained rather than sold as a product, there is no vendor support contract available directly through the project; teams that want commercial support and a hosted dashboard experience typically pair it with, or migrate to, tools like OWASP Dependency-Track or a commercial SCA platform.
It is used to scan a project's third-party dependencies and identify any that have publicly disclosed, known vulnerabilities (CVEs).
Yes, it is completely free and open source under the Apache License 2.0.
It gathers evidence about each dependency, maps it to Common Platform Enumeration identifiers, and cross-references the National Vulnerability Database to find matching CVE records.
It has strongest native support for Java and .NET, with additional checks for JavaScript, Ruby, and other ecosystems via integrated data sources like the NPM Audit API and Bundler Audit.
Dependency-Check is a software composition analysis tool that scans dependencies for known vulnerable libraries, while OWASP ZAP is a dynamic application security testing tool that actively scans and attacks a running web application.
Yes, it integrates with Jenkins, GitHub Actions, and Azure DevOps, as well as Maven, Gradle, and Ant plugins for build-time scanning.
Alternatives and complementary tools include OWASP Dependency-Track, Snyk, Mend (formerly WhiteSource), and GitHub Dependabot.
It was created by Jeremy Long and is maintained by a community of volunteer contributors under the OWASP Foundation.