This is an automated email from the ASF dual-hosted git repository.
kfaraz pushed a commit to branch 38.0.0
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/38.0.0 by this push:
new 13725e46ada release: Suppress more netty 3.x false positive CVEs for
Druid 38 release
13725e46ada is described below
commit 13725e46ada757e251343802991e48e5a7d20b07
Author: Kashif Faraz <[email protected]>
AuthorDate: Wed Sep 23 22:11:07 2026 +0530
release: Suppress more netty 3.x false positive CVEs for Druid 38 release
---
owasp-dependency-check-suppressions.xml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/owasp-dependency-check-suppressions.xml
b/owasp-dependency-check-suppressions.xml
index e0fcfa3ca3e..409bb953872 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -320,6 +320,10 @@
<cve>CVE-2026-42579</cve> <!-- We don't use netty-codec-dns; Druid uses
JDK DNS resolution -->
<cve>CVE-2026-75596</cve> <!-- Fragmented ClientHello DoS in
SniHandler/SslClientHelloHandler; Netty 3.x has no SNI handler, only in 4.x -->
<cve>CVE-2026-75595</cve> <!-- SNI routing bypass via fragmented
ClientHello; Netty 3.x has no SslClientHelloHandler, only in 4.x -->
+ <cve>CVE-2026-73508</cve> <!-- DNS record decoder memory leak; only in
netty-codec-dns which is a 4.x-only artifact -->
+ <cve>CVE-2026-73507</cve> <!-- XmlFrameDecoder CPU exhaustion; only in
netty-codec-xml which is a 4.x-only artifact -->
+ <cve>CVE-2026-59902</cve> <!-- SctpMessageCompletionHandler memory
exhaustion; only in netty-transport-sctp 4.x; Druid uses NIO transport -->
+ <cve>CVE-2026-59903</cve> <!-- CorsHandler Vary header overwrite; only in
4.x; Druid's HTTP server is Jetty, not Netty -->
</suppress>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
