diff --git a/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java b/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java
index 6d2bc62..b4d6f03 100644
--- a/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java
+++ b/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java
@@ -14,6 +14,7 @@
 
 import java.io.Serializable;
 import java.net.URI;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 
@@ -212,6 +213,9 @@ public void setVersionRanges(@Nullable final List<String> versionRanges) {
    * @since 1.8.0
    */
   public List<URI> getExternalReferences() {
+    if (externalReferences == null) {
+      externalReferences = new ArrayList<>();
+    }
     return externalReferences;
   }