This is an automated email from the ASF dual-hosted git repository.
capistrant pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new b04bd4f1b64 suppress some new CVEs (#20689)
b04bd4f1b64 is described below
commit b04bd4f1b64d41849b0588edb3f3dc68ba30bc59
Author: Lucas Capistrant <[email protected]>
AuthorDate: Fri Oct 23 14:54:46 2026 -0500
suppress some new CVEs (#20689)
---
owasp-dependency-check-suppressions.xml | 48 ++++++++++++++++++++++++++++++++-
1 file changed, 47 insertions(+), 1 deletion(-)
diff --git a/owasp-dependency-check-suppressions.xml
b/owasp-dependency-check-suppressions.xml
index 9e61837a5dc..8ed1acd1101 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -820,18 +820,23 @@
polymorphic typing is enabled with generic type parameters or array
subtypes.
CVE-2026-83557: DefaultBaseTypeLimitingValidator omits
java.lang.Comparable from unsafe
base types, enabling arbitrary class instantiation via polymorphic
deserialization.
+ CVE-2026-91776: unbounded type-id cache growth with @JsonTypeInfo(use
= NAME, defaultImpl = ...).
+ CVE-2026-91777: quadratic forward-reference resolution with
@JsonIdentityInfo.
+ Neither Hadoop's client classes nor Parquet's classes reference these
annotations.
These CVEs affect jackson-databind shaded inside hadoop/parquet jars,
not Druid's own jackson-databind (2.22.x).
CVE-2026-68497: Not yet published in NVD, suppressed as appearing
only inside shaded jars -->
<notes><![CDATA[
file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
- parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ parquet-jackson-1.18.1.jar (shaded jackson-databind 2.22.2)
]]></notes>
<filePath
regex="true">.*/(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-databind/pom\.xml$</filePath>
<cve>CVE-2026-54512</cve>
<cve>CVE-2026-54513</cve>
<cve>CVE-2026-68497</cve>
<cve>CVE-2026-83557</cve>
+ <cve>CVE-2026-91776</cve>
+ <cve>CVE-2026-91777</cve>
</suppress>
<suppress>
@@ -849,10 +854,47 @@
<cve>CVE-2026-68494</cve> <!-- DoS in the async JSON parser of
jackson-core 2.18.6 shaded in hadoop-client-runtime 3.5.0. Druid and Hadoop do
not use the async parser. Remove when Hadoop uses jackson-core 2.18.8+ -->
</suppress>
+ <suppress>
+ <!-- CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, GHSA-mhm7-754m-9p8w:
@JsonIgnoreProperties,
+ @JsonIgnore (records), and @JsonView bypasses during deserialization.
+ CVE-2026-19032, CVE-2026-54514, CVE-2026-77310: Path,
InetSocketAddress, and InetAddress
+ deserialization resolving attacker-controlled input.
+ Each requires binding untrusted JSON into types that use these
annotations or field types.
+ Hadoop's client classes in hadoop-client-api reference none of these
annotations and read
+ JSON from cluster services (NameNode, KMS) as untyped maps. Druid's
own jackson-databind
+ (2.22.3) is not affected. parquet-jackson's jackson-databind (2.22.2)
already has these fixes.
+ Remove when Hadoop ships jackson-databind 2.18.10+. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-databind/pom\.xml$</filePath>
+ <cve>CVE-2026-19032</cve>
+ <cve>CVE-2026-54514</cve>
+ <cve>CVE-2026-54515</cve>
+ <cve>CVE-2026-59888</cve>
+ <cve>CVE-2026-59889</cve>
+ <cve>CVE-2026-77310</cve>
+ <vulnerabilityName>GHSA-mhm7-754m-9p8w</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-45205: StackOverflowError when loading YAML configuration
with cycles.
+ commons-configuration2 is shaded inside
hadoop-client-runtime-3.5.0.jar for Hadoop metrics2,
+ which loads properties files only. snakeyaml is not shaded into the
jar, so YAMLConfiguration
+ cannot load. Remove when Hadoop ships commons-configuration2 2.15.0+.
-->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded
commons-configuration2 2.10.1)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.apache\.commons/commons-configuration2/pom\.xml$</filePath>
+ <cve>CVE-2026-45205</cve>
+ </suppress>
+
<suppress>
<!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
CVE-2026-19203: Jetty HTTP/1.1 request smuggling via lone-LF chunk
terminators.
+ CVE-2024-6763: Jetty HttpURI authority parsing differs from browsers
(open redirect/SSRF).
+ Only fixed in Jetty 12.0.12; no Jetty 9.4 fix exists. No Hadoop
client class uses HttpURI.
All affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar. Druid
cannot upgrade
the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
@@ -864,6 +906,7 @@
<cve>CVE-2026-2332</cve>
<cve>CVE-2026-10050</cve>
<cve>CVE-2026-19203</cve>
+ <cve>CVE-2024-6763</cve>
</suppress>
<suppress>
@@ -871,6 +914,7 @@
NEW-ENVIRON flooding).
CVE-2026-77422, CVE-2026-77423: ReDoS in JLine's built-in grep/less
commands via
user-controlled regex.
+ CVE-2026-77420, CVE-2026-77421: ReDoS via JLine's HISTORY_IGNORE
variable and nano regex search.
JLine is shaded inside hadoop-client-runtime-3.5.0.jar and is used
only for Hadoop's interactive CLI shell. Druid does not expose a
JLine Telnet server
endpoint or interactive shell session. -->
@@ -882,6 +926,8 @@
<cve>CVE-2026-56740</cve>
<cve>CVE-2026-77422</cve>
<cve>CVE-2026-77423</cve>
+ <cve>CVE-2026-77420</cve>
+ <cve>CVE-2026-77421</cve>
</suppress>
<suppress>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
