This is an automated email from the ASF dual-hosted git repository. kfaraz pushed a commit to branch 38.0.0 in repository https://gitbox.apache.org/repos/asf/druid.git
commit 19ae9ec8e39f775702daa632b5ec9167ec5cb864 Author: Kashif Faraz <[email protected]> AuthorDate: Wed Sep 23 19:39:43 2026 +0530 release: Suppress false positive Netty 3.x CVEs --- owasp-dependency-check-suppressions.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml index 125c9b6c793..e0fcfa3ca3e 100644 --- a/owasp-dependency-check-suppressions.xml +++ b/owasp-dependency-check-suppressions.xml @@ -318,6 +318,8 @@ <cve>CVE-2026-50010</cve> <!-- Druid's Netty 3.x HTTP client does not use SslContextBuilder; gRPC/AWS SDK paths use managed SSL contexts --> <cve>CVE-2026-42578</cve> <!-- We don't use HttpProxyHandler; Druid uses a custom HTTP CONNECT tunnel via HttpClientCodec --> <cve>CVE-2026-42579</cve> <!-- We don't use netty-codec-dns; Druid uses JDK DNS resolution --> + <cve>CVE-2026-75596</cve> <!-- Fragmented ClientHello DoS in SniHandler/SslClientHelloHandler; Netty 3.x has no SNI handler, only in 4.x --> + <cve>CVE-2026-75595</cve> <!-- SNI routing bypass via fragmented ClientHello; Netty 3.x has no SslClientHelloHandler, only in 4.x --> </suppress> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
