diff --git a/src/pkg/scan/vuln/report.go b/src/pkg/scan/vuln/report.go
index ad4dedd03..c23d0db2b 100644
--- a/src/pkg/scan/vuln/report.go
+++ b/src/pkg/scan/vuln/report.go
@@ -15,6 +15,8 @@
 package vuln
 
 import (
+	"encoding/json"
+
 	v1 "github.com/goharbor/harbor/src/pkg/scan/rest/v1"
 )
 
@@ -30,6 +32,24 @@ type Report struct {
 	Vulnerabilities []*VulnerabilityItem `json:"vulnerabilities"`
 }
 
+// MarshalJSON custom function to dump nil slice of Vulnerabilities as empty slice
+// See https://github.com/goharbor/harbor/issues/11131 to get more details
+func (report *Report) MarshalJSON() ([]byte, error) {
+	type Alias Report
+
+	aux := &struct {
+		*Alias
+	}{
+		Alias: (*Alias)(report),
+	}
+
+	if aux.Vulnerabilities == nil {
+		aux.Vulnerabilities = []*VulnerabilityItem{}
+	}
+
+	return json.Marshal(aux)
+}
+
 // Merge ...
 func (report *Report) Merge(another *Report) *Report {
 	generatedAt := report.GeneratedAt