SonarQube Enterprise 2026.03 showing new vulnerabilities on unchanged source code

SonarQube Server / Community Build
1

SonarQube Enterprise 2026.03 showing new vulnerabilities on unchanged source code

Hello Community,

We are using SonarQube Server Enterprise 2026.03 and have observed an inconsistency in vulnerability reporting.

Environment:

  • SonarQube Version: 2026.03 Enterprise
  • Deployment Type: Zip
  • Database: postgress 15.10
  • Scanner Version: mvn sonar plugin :5.5.0.6356
  • Language: Java

Issue Description:

We noticed that SonarQube is reporting new vulnerability issues on source files that have not been modified recently.

Observations:

  • No source code changes were made in the impacted files.
  • The vulnerability was not visible in previous analyses.
  • The issue appeared after analysis executed on .
  • Git history confirms that the file has not been modified since .
  • Background tasks completed successfully without error.
  • We are observing this on multiple projects.

Questions:

  1. Is there any known issue in SonarQube Enterprise 2026.03 related to vulnerability count inconsistencies?
  2. Are there recommended checks to determine whether this is a false-positive or issue reclassification?

Additional Details:

  • Rule Key: java:S3740
  • Rule Name: XML parsers should not be vulnerable to XXE attack>
  • Vulnerability Severity: Blocker
  • Issue displayed on Dashboard:
  • Analysis Date: 21st septmber 2026
  • Last Commit Date of File: 18 Feb 2025

guidance would be appreciated.

Thank you.

2

Hello,

Welcome to the Sonar Community :sonar:

What you are seeing is typically attributed to a shallow clone or a fetch depth that is non-zero. See Checked-out code | SonarQube Server | Sonar Documentation.

What DevOps platform do you use? Can you verify that you checked out the full clone of your repository? Can you share your full build logs here (feel free to redact any sensitive info)? If you prefer to share with me privately, let me know.