ERROR: CveReachabilitySensor execution failed

chan-buchi · June 22, 2026, 11:20am

CI: Azure DevOps
C#
We started having the following errors since the update of the Microsoft hosted agents

SonarCloudAnalyze (SonarCloudAnalyze)

ERROR: CveReachabilitySensor execution failed java.lang.IllegalStateException: Cannot create jump with empty destinations at com.sonar.A.F$_C.<init>(na:3104)
at com.sonar.A.G$_A.A(na:2447) at com.sonar.A.E.A(na:807) at java.base/java.util.stream.Collectors.lambda$uniqKeysMapAccumulator$1(Unknown Source) at java.base/java.util.stream.ReduceOps$3ReducingSink.accept(Unknown Source) at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source) at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source) at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source) at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source) at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source) at com.sonar.A.E.B(na:2941) at com.sonar.A.E.C(na:2679) at com.sonar.C.B.A.A(na:1752) at com.sonar.A.D.B(na:1467) at com.sonar.A.D.A(na:1820) at com.sonar.sca.reachability.D.readUcfgs(na:153) at com.sonar.sca.reachability.D.A(na:1797) at com.sonar.sca.reachability.D.execute(na:1340) at org.sonar.s

Bruno_Novais · June 22, 2026, 5:21pm

Having same problem

22:30:44.544  DEBUG: Loaded 0 ucfgs from 1 files(s) in [/home/vsts/work/1/.sonarqube/out/ucfg2/cs]
##[error]22:30:44.547  ERROR: CveReachabilitySensor execution failed
java.lang.IllegalStateException: Cannot create jump with empty destinations
	at com.sonar.A.F$_C.<init>(na:3104)
	at com.sonar.A.G$_A.A(na:2447)
	at com.sonar.A.E.A(na:807)
	at java.base/java.util
22:30:44.547  ERROR: CveReachabilitySensor execution failed
java.lang.IllegalStateException: Cannot create jump with empty destinations
	at com.sonar.A.F$_C.<init>(na:3104)
	at com.sonar.A.G$_A.A(na:2447)
	at com.sonar.A.E.A(na:807)
##[error].stream.Collectors.lambda$uniqKeysMapAccumulator$1(Unknown Source)
	at java.base/java.util.stream.ReduceOps$3ReducingSink.accept(Unknown Source)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
	at java.base/java.util
.stream.Collectors.lambda$uniqKeysMapAccumulator$1(Unknown Source)
	at java.base/java.util.stream.ReduceOps$3ReducingSink.accept(Unknown Source)
	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
##[error].stream.AbstractPipeline.copyInto(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
	at java.base/java.util.stream.AbstractPi
.stream.AbstractPipeline.copyInto(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
##[error]peline.evaluate(Unknown Source)
	at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
	at com.sonar.A.E.B(na:2941)
	at com.sonar.A.E.C(na:2679)
	at com.sonar.C.B.A.A(na:1752)
	at com.sonar.A.D.B(na:1467)
	at com.sonar.A.D.A(na:1820)
	at
peline.evaluate(Unknown Source)
	at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
	at com.sonar.A.E.B(na:2941)
	at com.sonar.A.E.C(na:2679)
	at com.sonar.C.B.A.A(na:1752)
	at com.sonar.A.D.B(na:1467)
	at com.sonar.A.D.A(na:1820)
##[error]com.sonar.sca.reachability.D.readUcfgs(na:153)
	at com.sonar.sca.reachability.D.A(na:1797)
	at com.sonar.sca.reachability.D.execute(na:1340)
	at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:67)
	at org.sonar.scanner.sen
com.sonar.sca.reachability.D.readUcfgs(na:153)
	at com.sonar.sca.reachability.D.A(na:1797)
	at com.sonar.sca.reachability.D.execute(na:1340)
	at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:67)
##[error]sor.AbstractSensorsExecutor.executeSensors(AbstractSensorsExecutor.java:40)
	at org.sonar.scanner.sensor.ProjectSensorsExecutor.execute(ProjectSensorsExecutor.java:34)
	at org.sonar.scanner.scan.SpringProjectScanContainer.doAfterStart(SpringProjectScanCont
sor.AbstractSensorsExecutor.executeSensors(AbstractSensorsExecutor.java:40)
	at org.sonar.scanner.sensor.ProjectSensorsExecutor.execute(ProjectSensorsExecutor.java:34)
##[error]ainer.java:184)
	at org.sonar.scanner.spring.SpringComponentContainer.startComponents(SpringComponentContainer.java:206)
	at org.sonar.scanner.spring.SpringComponentContainer.execute(SpringComponentContainer.java:185)
	at org.sonar.scanner.bootstrap.Spring
ainer.java:184)
	at org.sonar.scanner.spring.SpringComponentContainer.startComponents(SpringComponentContainer.java:206)
	at org.sonar.scanner.spring.SpringComponentContainer.execute(SpringComponentContainer.java:185)
##[error]ScannerContainer.doAfterStart(SpringScannerContainer.java:508)
	at org.sonar.scanner.bootstrap.SpringScannerContainer.startComponents(SpringScannerContainer.java:442)
	at org.sonar.scanner.spring.SpringComponentContainer.execute(SpringComponentContainer.ja
ScannerContainer.doAfterStart(SpringScannerContainer.java:508)
	at org.sonar.scanner.bootstrap.SpringScannerContainer.startComponents(SpringScannerContainer.java:442)
##[error]va:185)
	at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:150)
	at org.sonar.scanner.spring.SpringComponentContainer.startComponents(SpringComponentContainer.java:206)
	at org.sonar.scanner.spring.SpringComponent
va:185)
	at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:150)
	at org.sonar.scanner.spring.SpringComponentContainer.startComponents(SpringComponentContainer.java:206)
##[error]Container.execute(SpringComponentContainer.java:185)
	at org.sonar.scanner.bootstrap.ScannerMain.runScannerEngine(ScannerMain.java:143)
	at org.sonar.scanner.bootstrap.ScannerMain.run(ScannerMain.java:58)
	at org.sonar.scanner.bootstrap.ScannerMain.main(Sc
Container.execute(SpringComponentContainer.java:185)
	at org.sonar.scanner.bootstrap.ScannerMain.runScannerEngine(ScannerMain.java:143)
	at org.sonar.scanner.bootstrap.ScannerMain.run(ScannerMain.java:58)
##[error]annerMain.java:42)
annerMain.java:42)

22:30:44.549  INFO: Sensor CveReachabilitySensor [cvereachability] (done) | time=106ms

ganncamp · June 22, 2026, 6:26pm

Hi all,

Welcome to the community and thanks for these reports!

@chan-buchi can you give me a little more detail here? What changed on the agent side?

And what devOps platform are you using?

@Bruno_Novais could you share a few more details? Are you on MS-hosted agents? On what platform?

Also, is this “just” an error in the analysis log, but the analysis succeeds in the end? Or is analysis erroring-out?

Thx,
Ann

ganncamp · June 22, 2026, 9:41pm

Hi again,

As a followup, we’ve disabled this feature until the fix can be deployed tomorrow morning (European time).

Ann

Bruno_Novais · June 23, 2026, 1:41am

Some key versions and details

Starting: SonarCloud Analyze
==============================================================================
Task         : Run Code Analysis
Description  : Run scanner and upload the results to SonarQube Cloud.
Version      : 4.2.5


SonarScanner for .NET 11.2.1

Image: ubuntu-latest

Starting: Initialize job
Agent name: 'Azure Pipelines 3'
Agent machine name: 'runnervm1kgjm'
Current agent version: '4.274.1'
Runner Image Provisioner
Hosted Compute Agent
Version: 20260611.554
Commit: 5e0782fdc9014723d3be820dd114dd31555c2bd1
Build Date: 2026-06-11T21:40:46Z

Downloading task: MicrosoftSecurityDevOps (1.18.2)
Downloading task: NuGetToolInstaller (1.273.0)
Downloading task: UseDotNet (2.274.2)
Downloading task: SonarCloudPrepare (4.2.5)
Downloading task: DotNetCoreCLI (2.274.1)
Downloading task: SonarCloudAnalyze (4.2.5)
Downloading task: SonarCloudPublish (4.2.5)

chan-buchi · June 23, 2026, 7:25am

Hello thanks for your answer.
We are using MS-hosted agents, there was an update last week from this runner:
ubuntu24/20260525.161 to this one ubuntu24/20260615.205
We use the latest, we are facing the same issue on the Windows runner too.
Nothing changed on our pipelines besides that.
It’s happening on different projects.
We are using the Entreprise SonarQube Cloud with Advanced Security.

Karim_El_Ouerghemmi · June 23, 2026, 9:35am

Thanks everybody for reporting.

Are you still seeing the error message in the logs as of this morning ?

chan-buchi · June 23, 2026, 9:42am

No, we don’t have the error message anymore

milbrandt · June 23, 2026, 3:26pm

yes, we are still seeing this issue

17:07:23.383  INFO: Sensor CveReachabilitySensor [cvereachability]
##[error]17:07:25.368  ERROR: CveReachabilitySensor execution failed
java.lang.IllegalStateException: Cannot create jump with empty destinations
	at com.sonar.A.F$_C.<init>(na:3104)
	at com.sonar.A.G$_A.A(na:2447)
	at com.sonar.A.E.A(na:807)
	at java.base/java.util.stream.Collectors.lambda$uniqKeysMapAccumulator$1(Unknown Source)

Azure DevOps Services, self hosted build agents on Windows with Visual Studio 2026
Build contains mixed C#/C++ solution, using build wrapper and msbuild.
Task AnalyzeSonarCloud@4.2.5
The task reports it as error but does not fail the pipeline.

Karim_El_Ouerghemmi · June 23, 2026, 3:49pm

Thanks @milbrandt for the helpful ping It seems that the fix didn’t fully reach production. Feature will be disabled again temporarily until deployment is complete.

Topic		Replies	Views
Sonar Analysis fails on Private VM but is successful on Microsoft Hosted Agent SonarQube Cloud scanner , azuredevops-services , sonarqube-cloud	1	925	August 3, 2021
SonarAnalyze@5.14.0 Azure Pipelines Task Failing SonarQube Server / Community Build azuredevops-services	5	1235	June 14, 2023
SonarQube server can not be reached SonarQube Server / Community Build java , azuredevops-services , coverage , dotnet , azuredevops	4	431	June 12, 2024
SONARQUBE_SCANNER_PARAMS environment variable Error When using Lower than Java 17 version SonarQube Cloud scanner , bump , sonarqube-cloud	16	1267	March 19, 2024
DevOPS SonarCloud: Symbolic analysis was interrupted because of an unexpected error SonarQube Cloud security , sonarqube-cloud	12	1876	January 3, 2022

ERROR: CveReachabilitySensor execution failed

Related topics