This is an automated email from the ASF dual-hosted git repository.
kfaraz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 206e3c9f85e minor: suppress CVE-2026-68494 as non-targetable (#20615)
206e3c9f85e is described below
commit 206e3c9f85e40ebe45da3cb75f411bb621bd49a4
Author: Sasha Syrotenko <[email protected]>
AuthorDate: Fri Oct 16 15:26:14 2026 +0300
minor: suppress CVE-2026-68494 as non-targetable (#20615)
---
owasp-dependency-check-suppressions.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/owasp-dependency-check-suppressions.xml
b/owasp-dependency-check-suppressions.xml
index fd771507518..9e61837a5dc 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -846,6 +846,7 @@
<cve>CVE-2026-89407</cve>
<cve>CVE-2026-68498</cve>
<cve>CVE-2026-89425</cve>
+ <cve>CVE-2026-68494</cve> <!-- DoS in the async JSON parser of
jackson-core 2.18.6 shaded in hadoop-client-runtime 3.5.0. Druid and Hadoop do
not use the async parser. Remove when Hadoop uses jackson-core 2.18.8+ -->
</suppress>
<suppress>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
