capistrant opened a new pull request, #20689: URL: https://github.com/apache/druid/pull/20689
# CVE suppressions: shaded deps in hadoop-client-runtime and parquet-jackson ## hadoop-client-runtime 3.5.0 No newer Hadoop release exists. Remove each suppression once Hadoop bundles the fixed library. | CVE | Why it's safe to suppress | Removable when | |---|---|---| | CVE-2026-91776 (High) | Needs `@JsonTypeInfo` with `defaultImpl`; no Hadoop client class uses it | Hadoop bundles jackson-databind 2.18.11+ | | CVE-2026-91777 (High) | Needs `@JsonIdentityInfo`; no Hadoop client class uses it | Hadoop bundles jackson-databind 2.18.11+ | | CVE-2026-19032 | Needs a `Path` field bound from untrusted JSON; Hadoop reads JSON from its own cluster services into untyped maps | Hadoop bundles jackson-databind 2.18.10+ | | CVE-2026-54514 | Needs an `InetSocketAddress` field bound from untrusted JSON; same untyped-map reads | Hadoop bundles jackson-databind 2.18.8+ | | CVE-2026-77310 | Needs an `InetAddress` field bound from untrusted JSON; same untyped-map reads | Hadoop bundles jackson-databind 2.18.9+ | | CVE-2026-54515 | Needs `@JsonIgnoreProperties` plus case-insensitive matching; Hadoop uses neither | Hadoop bundles jackson-databind 2.18.9+ | | CVE-2026-59888 | Needs Java records with `@JsonIgnore` and a naming strategy; Hadoop uses none | Hadoop bundles jackson-databind 2.18.8+ | | CVE-2026-59889 | Needs `@JsonView` with `@JsonUnwrapped`; Hadoop uses neither | Hadoop bundles jackson-databind 2.18.9+ | | GHSA-mhm7-754m-9p8w | Needs `@JsonView` with `@JsonTypeInfo`; Hadoop uses neither | Hadoop bundles jackson-databind 2.18.9+ | | CVE-2026-45205 | Only YAML configs trigger it; Hadoop loads its metrics config from `.properties`, and the YAML library isn't in the jar | Hadoop bundles commons-configuration2 2.15.0+ | | CVE-2026-77420 | Needs an interactive JLine terminal; only Hadoop's YARN container shell uses JLine, and Druid doesn't | Hadoop bundles JLine 3.30.15+ | | CVE-2026-77421 | Needs JLine's nano editor in an interactive session; Druid never starts one | Hadoop bundles JLine 3.30.15+ | | CVE-2024-6763 | Needs Jetty's `HttpURI` URL parser; no Hadoop client class uses it, and Druid runs its own Jetty 12 | Hadoop moves off Jetty 9.4 (only Jetty 12.0.12+ has the fix) | ## parquet-jackson 1.18.1 1.18.1 is the latest Parquet release. | CVE | Why it's safe to suppress | Removable when | |---|---|---| | CVE-2026-91776 (High) | No Parquet class uses `@JsonTypeInfo`; Parquet's Jackson use (encryption keys, file-metadata JSON) is code Druid doesn't call | Parquet bundles jackson-databind 2.22.3+ | | CVE-2026-91777 (High) | No Parquet class uses `@JsonIdentityInfo`; same limited Jackson use | Parquet bundles jackson-databind 2.22.3+ | Druid's own jackson-databind is 2.22.3, which already has every Jackson fix above. ___ `parquet-jackson` I have expectation of a patched version before Druid 40. Hadoop client... I doubt it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
