Actual fix: the database product was reported as “PostgreSQL” by the driver. As the custom “Locale” used in the ResourceBundle is case-sensitive, the mixed-case properties file fails to be resolved (at least on case-sensitive file systems)

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java

@@ -231,7 +231,7 @@ public final class CveDB implements AutoCloseable {
      */
     private static String determineDatabaseProductName(Connection conn) {
         try {
-            final String databaseProductName = conn.getMetaData().getDatabaseProductName();
+            final String databaseProductName = conn.getMetaData().getDatabaseProductName().toLowerCase();
             LOGGER.debug("Database product: {}", databaseProductName);
             return databaseProductName;
         } catch (SQLException se) {