Copilot commented on code in PR #20335:
URL: https://github.com/apache/druid/pull/20335#discussion_r4025964018
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +857,165 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised.
+ Update to version 11.1.1 or 12.0.1 to remove this suppression
+ -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ The CVE fires against azure-core, azure-core-http-netty,
azure-identity, and azure-json due to broad CPE
+ matching, but none of these jars contain the vulnerable Key Vault
code path. Druid uses these artifacts
+ for blob storage auth only and does not use the Key Vault
cryptography client. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.azure/(azure-core|azure-core-http-netty|azure-identity|azure-json)@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside hadoop/parquet jars,
+ not Druid's own jackson-databind (2.22.x).
+ CVE-2026-68497: Not yet published in NVD, suppressed as appearing
only inside shaded jars -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <filePath
regex="true">(?:.*/)?(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-databind/pom\.xml$</filePath>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar.
Druid cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded org.eclipse.jetty*
9.4.58.v20250814)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.eclipse\.jetty[^/]*/[^/]*/pom\.xml$</filePath>
+ <cve>CVE-2026-2332</cve>
+ <cve>CVE-2026-10050</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-56741, CVE-2026-56740: DoS via JLine Telnet server (NAWS
terminal dimensions and
+ NEW-ENVIRON flooding). JLine is shaded inside
hadoop-client-runtime-3.5.0.jar and is used
+ only for Hadoop's interactive CLI shell. Druid does not expose a
JLine Telnet server endpoint. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jline 3.9.0)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.jline/jline[^/]*/pom\.xml$</filePath>
+ <cve>CVE-2026-56741</cve>
+ <cve>CVE-2026-56740</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-24051, CVE-2026-39883, CVE-2026-29181: All three affect the
OpenTelemetry Go SDK
+ (opentelemetry-go), not any Java library. The scanner matches
opentelemetry-gcp-resources
+ (a Java artifact) against the Go SDK CPE due to the shared
"opentelemetry" product name.
+ Druid's google-extensions use the Java opentelemetry-gcp-resources
for GCP resource
+ detection; the vulnerable PATH hijacking and baggage-header
amplification code exists
+ only in the Go implementation. -->
+ <notes><![CDATA[
+ file name: opentelemetry-gcp-resources-1.37.0-alpha.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/io\.opentelemetry\.contrib/opentelemetry-gcp-resources@.*$</packageUrl>
+ <cve>CVE-2026-24051</cve>
+ <cve>CVE-2026-39883</cve>
+ <cve>CVE-2026-29181</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-40542, CVE-2026-71290: Vulnerabilities in Apache HttpClient
5 (SCRAM mutual auth
+ and async hostname verification). CVE-2026-54399, CVE-2026-54428: DoS
in Apache HttpComponents
+ Core 5 (excessive headers and HTTP/2 HPACK). All four affect
httpclient5/httpcore5 shaded
+ inside docker-java-transport-zerodep-3.7.1.jar (a test-scoped
dependency used only by
+ druid-testcontainers for Docker container management in tests). These
are not present in
+ Druid's production runtime classpath. -->
+ <notes><![CDATA[
+ file name: docker-java-transport-zerodep-3.7.1.jar (shaded httpclient5
5.5.1 and httpcore5 5.3.6)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.httpcomponents\.(client5/httpclient5|core5/(httpcore5|httpcore5-h2))@.*$</packageUrl>
+ <cve>CVE-2026-40542</cve>
+ <cve>CVE-2026-71290</cve>
+ <cve>CVE-2026-54399</cve>
+ <cve>CVE-2026-54428</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-87823: Out-of-bounds memory read in ByteBuffer frame-size
methods via negative offset values.
+ CVE-2026-87795: Out-of-bounds memory read in ZstdDictCompress
constructor via unvalidated offset/length.
+ Both are fixed in zstd-jni 1.5.7-14. Suppressed until zstd-jni is
upgraded.
+ Based on the analysis in
https://github.com/apache/druid/pull/20236#issuecomment-5646494509,
+ this vulnerability should not affect Druid since the relevant code
paths do not get activated
+ -->
+ <notes><![CDATA[
+ file name: zstd-jni-1.5.7-11.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.github\.luben/zstd-jni@1\.5\.7-7$</packageUrl>
+ <cve>CVE-2026-87823</cve>
+ <cve>CVE-2026-87795</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-90559: Out-of-bounds write in Snappy.uncompress(ByteBuffer,
ByteBuffer) — the
+ destination buffer capacity is never validated against the
decompressed size, allowing
+ attacker-controlled compressed input to crash the JVM. No fix is
available upstream yet
+ (xerial/snappy-java#728, opened 2026-08-14).
+ Druid does not call org.xerial.snappy directly; snappy-java is a
transitive dependency
+ (pulled in by Kafka, Parquet, etc.). Druid's own snappy decompression
uses Apache Commons
+ Compress (FramedSnappyCompressorInputStream), not the xerial
Snappy.uncompress path.
+ The vulnerable ByteBuffer overload is therefore not reachable from
Druid code. -->
Review Comment:
The vulnerable overload is reachable through Druid's Parquet extension:
`parquet-extensions` includes `parquet-hadoop`, and Parquet's
`SnappyDecompressor` calls `Snappy.uncompress(ByteBuffer, ByteBuffer)`, which
is the exact CVE-2026-90559 entry point. Thus the assertion that the overload
is not reachable from Druid code is false; a crafted Snappy-compressed Parquet
input can exercise it. Upgrade or patch the dependency, or remove this
suppression after a concrete mitigation rather than suppressing the finding.
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +857,165 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised.
+ Update to version 11.1.1 or 12.0.1 to remove this suppression
+ -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ The CVE fires against azure-core, azure-core-http-netty,
azure-identity, and azure-json due to broad CPE
+ matching, but none of these jars contain the vulnerable Key Vault
code path. Druid uses these artifacts
+ for blob storage auth only and does not use the Key Vault
cryptography client. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.azure/(azure-core|azure-core-http-netty|azure-identity|azure-json)@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside hadoop/parquet jars,
+ not Druid's own jackson-databind (2.22.x).
+ CVE-2026-68497: Not yet published in NVD, suppressed as appearing
only inside shaded jars -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <filePath
regex="true">(?:.*/)?(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-databind/pom\.xml$</filePath>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar.
Druid cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded org.eclipse.jetty*
9.4.58.v20250814)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.eclipse\.jetty[^/]*/[^/]*/pom\.xml$</filePath>
+ <cve>CVE-2026-2332</cve>
+ <cve>CVE-2026-10050</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-56741, CVE-2026-56740: DoS via JLine Telnet server (NAWS
terminal dimensions and
+ NEW-ENVIRON flooding). JLine is shaded inside
hadoop-client-runtime-3.5.0.jar and is used
+ only for Hadoop's interactive CLI shell. Druid does not expose a
JLine Telnet server endpoint. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jline 3.9.0)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.jline/jline[^/]*/pom\.xml$</filePath>
+ <cve>CVE-2026-56741</cve>
+ <cve>CVE-2026-56740</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-24051, CVE-2026-39883, CVE-2026-29181: All three affect the
OpenTelemetry Go SDK
+ (opentelemetry-go), not any Java library. The scanner matches
opentelemetry-gcp-resources
+ (a Java artifact) against the Go SDK CPE due to the shared
"opentelemetry" product name.
+ Druid's google-extensions use the Java opentelemetry-gcp-resources
for GCP resource
+ detection; the vulnerable PATH hijacking and baggage-header
amplification code exists
+ only in the Go implementation. -->
+ <notes><![CDATA[
+ file name: opentelemetry-gcp-resources-1.37.0-alpha.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/io\.opentelemetry\.contrib/opentelemetry-gcp-resources@.*$</packageUrl>
+ <cve>CVE-2026-24051</cve>
+ <cve>CVE-2026-39883</cve>
+ <cve>CVE-2026-29181</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-40542, CVE-2026-71290: Vulnerabilities in Apache HttpClient
5 (SCRAM mutual auth
+ and async hostname verification). CVE-2026-54399, CVE-2026-54428: DoS
in Apache HttpComponents
+ Core 5 (excessive headers and HTTP/2 HPACK). All four affect
httpclient5/httpcore5 shaded
+ inside docker-java-transport-zerodep-3.7.1.jar (a test-scoped
dependency used only by
+ druid-testcontainers for Docker container management in tests). These
are not present in
+ Druid's production runtime classpath. -->
+ <notes><![CDATA[
+ file name: docker-java-transport-zerodep-3.7.1.jar (shaded httpclient5
5.5.1 and httpcore5 5.3.6)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.httpcomponents\.(client5/httpclient5|core5/(httpcore5|httpcore5-h2))@.*$</packageUrl>
+ <cve>CVE-2026-40542</cve>
+ <cve>CVE-2026-71290</cve>
+ <cve>CVE-2026-54399</cve>
+ <cve>CVE-2026-54428</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-87823: Out-of-bounds memory read in ByteBuffer frame-size
methods via negative offset values.
+ CVE-2026-87795: Out-of-bounds memory read in ZstdDictCompress
constructor via unvalidated offset/length.
+ Both are fixed in zstd-jni 1.5.7-14. Suppressed until zstd-jni is
upgraded.
+ Based on the analysis in
https://github.com/apache/druid/pull/20236#issuecomment-5646494509,
+ this vulnerability should not affect Druid since the relevant code
paths do not get activated
+ -->
+ <notes><![CDATA[
+ file name: zstd-jni-1.5.7-11.jar
Review Comment:
The suppression selector targets `[email protected]`, which is the version
resolved by this branch (`pom.xml:698-701`), but the note and linked
reachability analysis refer to `1.5.7-11`. Update the recorded jar and confirm
that the API-level analysis also applies to 1.5.7-7 before suppressing these
CVEs for the 38 release.
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +857,165 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised.
+ Update to version 11.1.1 or 12.0.1 to remove this suppression
+ -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ The CVE fires against azure-core, azure-core-http-netty,
azure-identity, and azure-json due to broad CPE
+ matching, but none of these jars contain the vulnerable Key Vault
code path. Druid uses these artifacts
+ for blob storage auth only and does not use the Key Vault
cryptography client. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.azure/(azure-core|azure-core-http-netty|azure-identity|azure-json)@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside hadoop/parquet jars,
+ not Druid's own jackson-databind (2.22.x).
+ CVE-2026-68497: Not yet published in NVD, suppressed as appearing
only inside shaded jars -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <filePath
regex="true">(?:.*/)?(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-databind/pom\.xml$</filePath>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar.
Druid cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded org.eclipse.jetty*
9.4.58.v20250814)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.eclipse\.jetty[^/]*/[^/]*/pom\.xml$</filePath>
Review Comment:
Dependency Check reports the shaded path at the archive root (for example,
`hadoop-client-runtime-3.5.0.jar/META-INF/maven/org.eclipse.jetty/jetty-io/pom.xml`),
but this expression starts with `.*/`, which requires a directory separator
before `hadoop-client-runtime`. It therefore does not match the root-level
finding, so CVE-2026-2332 and CVE-2026-10050 remain unsuppressed. Make the
prefix optional.
This issue also appears on line 953 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
