FrankChen021 commented on code in PR #20236:
URL: https://github.com/apache/druid/pull/20236#discussion_r3949717420
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside
hadoop-client-runtime-3.5.0.jar and
+ parquet-jackson-1.18.0.jar — not Druid's own jackson-databind
(2.22.x). Druid cannot
+ upgrade the jackson version inside these third-party shaded jars.
Druid's own usage of
+ @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected
by these bypass paths.
+ CVE-2026-68497: Not yet published in NVD; suppressed as appearing
only inside shaded
+ hadoop/parquet jars that Druid cannot control. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl>
Review Comment:
[P1] Scope Jackson suppressions to the shaded jars
`packageUrl` is the only matching condition here; the `file name` in
`<notes>` is informational, so this regex also matches Druid's normal
`com.fasterxml.jackson.core:jackson-databind` dependency. The root POM manages
that dependency at 2.22.2, which falls in `2.22.*`, meaning these CVEs are
suppressed for the production Jackson artifact as well as the shaded
2.18.6/2.22.1 copies. Please scope this to the Hadoop/Parquet container (or
otherwise distinguish the shaded artifact) instead of suppressing the same GAV
globally.
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
Review Comment:
[P2] Do not match every Azure artifact
The regex is broader than the artifacts listed in the notes: it matches
`com.azure:azure-security-keyvault-keys`, which is the package named by
CVE-2026-33117, in addition to `azure-core`/`azure-identity`/storage clients.
Because notes do not constrain the rule, any future Key Vault Keys dependency
would have this critical CVE silently suppressed. Match the specific
non-vulnerable GAVs (or the containing jar) instead.
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside
hadoop-client-runtime-3.5.0.jar and
+ parquet-jackson-1.18.0.jar — not Druid's own jackson-databind
(2.22.x). Druid cannot
+ upgrade the jackson version inside these third-party shaded jars.
Druid's own usage of
+ @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected
by these bypass paths.
+ CVE-2026-68497: Not yet published in NVD; suppressed as appearing
only inside shaded
+ hadoop/parquet jars that Druid cannot control. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar.
Druid cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jetty-http/jetty-io
9.4.58.v20250814)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-(http|io)@9\.4\.58.*$</packageUrl>
+ <cve>CVE-2026-2332</cve>
+ <cve>CVE-2026-10050</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-56741, CVE-2026-56740: DoS via JLine Telnet server (NAWS
terminal dimensions and
+ NEW-ENVIRON flooding). JLine is shaded inside
hadoop-client-runtime-3.5.0.jar and is used
+ only for Hadoop's interactive CLI shell. Druid does not expose a
JLine Telnet server endpoint. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jline 3.9.0)
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.jline/jline@.*$</packageUrl>
Review Comment:
[P2] Match JLine's remote Telnet module
The affected Maven package for both CVEs is `org.jline:jline-remote-telnet`,
not `org.jline:jline`. Hadoop's 3.5.0 runtime embeds the `jline-remote-telnet`
module and its shaded Telnet classes, and Dependency-Check analyzes embedded
Maven POMs as separate package identifiers. This exact `jline` purl therefore
misses the reported package, so the suppression will not clear these findings.
Match `jline-remote-telnet` (and any other reported embedded modules)
explicitly.
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside
hadoop-client-runtime-3.5.0.jar and
+ parquet-jackson-1.18.0.jar — not Druid's own jackson-databind
(2.22.x). Druid cannot
+ upgrade the jackson version inside these third-party shaded jars.
Druid's own usage of
+ @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected
by these bypass paths.
+ CVE-2026-68497: Not yet published in NVD; suppressed as appearing
only inside shaded
+ hadoop/parquet jars that Druid cannot control. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar.
Druid cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jetty-http/jetty-io
9.4.58.v20250814)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-(http|io)@9\.4\.58.*$</packageUrl>
Review Comment:
[P2] Include the Jetty artifact for CVE-2026-10050
This pattern matches only purls for `jetty-http` and `jetty-io`.
CVE-2026-10050 is associated with Jetty's `jetty-security` artifact and its
`DigestAuthentication` code in `jetty-client`; neither identifier matches this
alternation. Thus the second CVE remains unsuppressed even if it is reported
from the embedded Hadoop runtime. Split the CVEs and match the actual reported
embedded artifact(s), or the containing Hadoop jar.
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside
hadoop-client-runtime-3.5.0.jar and
+ parquet-jackson-1.18.0.jar — not Druid's own jackson-databind
(2.22.x). Druid cannot
+ upgrade the jackson version inside these third-party shaded jars.
Druid's own usage of
+ @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected
by these bypass paths.
+ CVE-2026-68497: Not yet published in NVD; suppressed as appearing
only inside shaded
+ hadoop/parquet jars that Druid cannot control. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar.
Druid cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jetty-http/jetty-io
9.4.58.v20250814)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-(http|io)@9\.4\.58.*$</packageUrl>
+ <cve>CVE-2026-2332</cve>
+ <cve>CVE-2026-10050</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-56741, CVE-2026-56740: DoS via JLine Telnet server (NAWS
terminal dimensions and
+ NEW-ENVIRON flooding). JLine is shaded inside
hadoop-client-runtime-3.5.0.jar and is used
+ only for Hadoop's interactive CLI shell. Druid does not expose a
JLine Telnet server endpoint. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jline 3.9.0)
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.jline/jline@.*$</packageUrl>
+ <cve>CVE-2026-56741</cve>
+ <cve>CVE-2026-56740</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-24051, CVE-2026-39883, CVE-2026-29181: All three affect the
OpenTelemetry Go SDK
+ (opentelemetry-go), not any Java library. The scanner matches
opentelemetry-gcp-resources
+ (a Java artifact) against the Go SDK CPE due to the shared
"opentelemetry" product name.
+ Druid's google-extensions use the Java opentelemetry-gcp-resources
for GCP resource
+ detection; the vulnerable PATH hijacking and baggage-header
amplification code exists
+ only in the Go implementation. -->
+ <notes><![CDATA[
+ file name: opentelemetry-gcp-resources-1.37.0-alpha.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/io\.opentelemetry\.contrib/opentelemetry-gcp-resources@.*$</packageUrl>
+ <cve>CVE-2026-24051</cve>
+ <cve>CVE-2026-39883</cve>
+ <cve>CVE-2026-29181</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-40542, CVE-2026-71290: Vulnerabilities in Apache HttpClient
5 (SCRAM mutual auth
+ and async hostname verification). CVE-2026-54399, CVE-2026-54428: DoS
in Apache HttpComponents
+ Core 5 (excessive headers and HTTP/2 HPACK). All four affect
httpclient5/httpcore5 shaded
+ inside docker-java-transport-zerodep-3.7.1.jar (a test-scoped
dependency used only by
+ druid-testcontainers for Docker container management in tests). These
are not present in
+ Druid's production runtime classpath. -->
+ <notes><![CDATA[
+ file name: docker-java-transport-zerodep-3.7.1.jar (shaded httpclient5
5.5.1 and httpcore5 5.3.6)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.httpcomponents\.(client5/httpclient5|core5/httpcore5)@.*$</packageUrl>
Review Comment:
[P2] Include httpcore5-h2 in the suppression
CVE-2026-54428 is published for
`org.apache.httpcomponents.core5:httpcore5-h2`, but the alternation covers only
`core5/httpcore5` and omits `core5/httpcore5-h2`.
`docker-java-transport-zerodep-3.7.1.jar` embeds httpcore5-h2 5.3.6 separately,
so the HTTP/2 CVE remains reported. Add `core5/httpcore5-h2` to the rule or
scope it to the containing test jar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
