FrankChen021 commented on code in PR #20236:
URL: https://github.com/apache/druid/pull/20236#discussion_r3968641398
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -274,6 +320,69 @@
<cve>CVE-2025-58057</cve> <!-- Netty 3.x not affected; compression issue
only in 4.x -->
<cve>CVE-2026-33870</cve> <!-- We don't use HttpPostRequestDecoder -->
<cve>CVE-2026-33871</cve> <!-- Netty 3.x not affected; HTTP/2 issues only
in 4.x -->
+ <cve>CVE-2026-44893</cve> <!-- We don't use the HAProxy codec -->
+ <cve>CVE-2026-44250</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-48059</cve> <!-- We don't use the HAProxy codec -->
+ <cve>CVE-2026-44890</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-44891</cve> <!-- We don't use the STOMP codec -->
+ <cve>CVE-2026-50011</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-59901</cve> <!-- We don't use Netty's Bzip2Decoder; Druid
uses Apache Commons Compress for bzip2 -->
+ <cve>CVE-2026-62380</cve> <!-- We don't use the SOCKS codec; Druid uses
HTTP CONNECT proxy tunneling -->
+ <cve>CVE-2026-59898</cve> <!-- Server-side WebSocket vulnerability;
Druid's HTTP server is Jetty, not Netty -->
+ <cve>CVE-2026-59899</cve> <!-- Server-side HttpContentEncoder
vulnerability; Druid uses Netty 3.x as HTTP client only -->
+ <cve>CVE-2026-42587</cve> <!-- Affects brotli/zstd/snappy decompression
added in Netty 4.x; Netty 3.x only supports gzip/deflate -->
+ <cve>CVE-2026-42586</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-44248</cve> <!-- We don't use the MQTT codec -->
+ <cve>CVE-2026-44249</cve> <!-- We don't use Netty's IpSubnetFilterRule;
Druid uses Jetty for HTTP access control -->
+ <cve>CVE-2026-45416</cve> <!-- Server-side TLS SNI vulnerability; Druid
uses Netty 3.x as TLS client only, never as a server -->
+ <cve>CVE-2026-42581</cve> <!-- Server-side HTTP request smuggling; Druid's
HTTP server is Jetty, not Netty -->
+ <cve>CVE-2026-45674</cve> <!-- Affects netty-resolver-dns which Druid
doesn't use; Druid uses JDK DNS resolution -->
+ <cve>CVE-2026-48006</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-42585</cve> <!-- Server-side HTTP request smuggling; Druid's
HTTP server is Jetty, not Netty -->
+ <cve>CVE-2026-42584</cve> <!-- HttpClientCodec response desynchronization
in Netty 4.x codec; Druid uses Netty 3.x's HttpClientCodec which has a
different implementation -->
Review Comment:
Thanks for the clarification. I rechecked the current head and agree that
Druid does not intentionally pipeline requests, but the Netty 3/client
lifecycle still creates the same overlap when a peer sends an interim 103:
- Netty 3 `HttpClientCodec` skips request-method dequeuing only for status
100; for 103 it polls the queued method, while the base decoder treats the 1xx
response as content-empty.
- `NettyHttpClient` then calls `finishRequest()` for every non-chunked
response and returns the channel to `ResourcePool`. The next request can
therefore be written on that channel while the prior request's final response
is still outstanding: de facto pipelining caused by the decoder's premature
completion.
The absence of HEAD requests does not remove this 103 path. Even for
Druid-to-Druid traffic, a misbehaving or compromised peer can trigger it.
Unless this is being accepted as an explicit trusted-peer risk, I recommend
keeping CVE-2026-42584 unsuppressed until the client waits for the final
response or is patched/upgraded.
Reviewed 1 of 1 changed files.
<!-- mergelens:review -->
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside
hadoop-client-runtime-3.5.0.jar and
+ parquet-jackson-1.18.0.jar — not Druid's own jackson-databind
(2.22.x). Druid cannot
+ upgrade the jackson version inside these third-party shaded jars.
Druid's own usage of
+ @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected
by these bypass paths.
+ CVE-2026-68497: Not yet published in NVD; suppressed as appearing
only inside shaded
+ hadoop/parquet jars that Druid cannot control. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl>
Review Comment:
Thanks — I rechecked the current head, and this remains unresolved. At line
959, `packageUrl` is still the only matching condition, and the regex matches
`pkg:maven/com.fasterxml.jackson.core/[email protected]`, which is
Druid's ordinary dependency (root `pom.xml` manages Jackson at 2.22.2) as well
as the shaded findings described in the notes. The `file name` text inside
`<notes>` is documentation only and does not scope a suppression. Please add a
file/component matcher (or otherwise distinguish the shaded Hadoop/Parquet
jars) before merging.
Reviewed 1 of 1 changed files.
<!-- mergelens:review -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
