dependency-check-suppression.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- For information see https://jeremylong.github.io/DependencyCheck/general/suppression.html -->

<!-- False Positive. This CVE is against neo4j not neo4j bolt
-->
<suppress>
   <notes><![CDATA[
   file name: neo4j-bolt-connection-1.0.0.jar
   file name: neo4j-bolt-connection-netty-1.0.0.jar
   file name: neo4j-bolt-connection-pooled-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.neo4j\.bolt/neo4j-bolt-.*@.*$</packageUrl>
   <cve>CVE-2021-34371</cve>
</suppress>

<!-- False Positive
     This CVE is against the GlassFish application server, but is mistakenly being
     identified in various org.glassfish artifacts
https://github.com/jeremylong/DependencyCheck/issues/7021
https://github.com/jeremylong/DependencyCheck/issues/7020
https://github.com/jeremylong/DependencyCheck/issues/7019
-->
<suppress>
   <notes><![CDATA[
   file name: jakarta.el-4.0.2.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.glassfish.*/(jakarta\.el|jaxb-core|jaxb-runtime|osgi-resource-locator|txw2)@.*$</packageUrl>
   <cve>CVE-2024-9329</cve>
</suppress>

<!-- This CVE is against the etcd server. We use the Java client
-->
<suppress>
   <notes><![CDATA[
   file name: etcd4j-2.17.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.mousio/etcd4j@.*$</packageUrl>
   <cpe>cpe:/a:etcd:etcd</cpe>
</suppress>

<!-- False positive.
     This CVE is against the H2 web admin console which we do not use
-->
<suppress>
   <notes><![CDATA[
   file name: h2-2.1.212.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
   <cve>CVE-2022-45868</cve>
</suppress>

<!-- False Positive. This CVE is against H2 1.x.
-->
<suppress>
   <notes><![CDATA[
   file name: h2-2.1.212.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.h2database/h2@.*$</packageUrl>
   <vulnerabilityName>CVE-2018-14335</vulnerabilityName>
</suppress>

<!-- False Positive. This CVE is against the Maven plugins listed here:
     https://maven.apache.org/security.html
     Our dependency is on  maven-artifact-manager which is not in this list.
-->
<suppress>
   <notes><![CDATA[
   file name: maven-artifact-manager-2.2.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.apache\.maven/maven\-artifact\-manager@.*$</packageUrl>
   <vulnerabilityName>CVE-2021-26291</vulnerabilityName>
</suppress>

<!-- False Positive. This does not apply to server Java deployment and certainly not to our use of graalvm SDK.
    This vulnerability applies to Java deployments, typically in clients running sandboxed
    Java Web Start applications or sandboxed Java applets, that load and run untrusted code
    (e.g., code that comes from the internet) and rely on the Java sandbox for security. This
    vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code
-->
<suppress>
   <notes><![CDATA[
   file name: nativeimage-23.1.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\.sdk/graal\-sdk@.*$</packageUrl>
   <vulnerabilityName>CVE-2023-22006</vulnerabilityName>
</suppress>

<!-- This low priority CVE does not apply to our use of the graalvm compiler.
-->
<suppress>
   <notes><![CDATA[
   file name: compiler-23.1.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\.compiler/compiler@.*$</packageUrl>
   <vulnerabilityName>CVE-2024-21138</vulnerabilityName>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: compiler-23.1.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.graalvm\.compiler/compiler@.*$</packageUrl>
   <vulnerabilityName>CVE-2024-21235</vulnerabilityName>
</suppress>

<!--
    This is a FP. We have upgrade jgit to a fixed version, but it is still getting flagged.
    Probably due to the funky version string used by jgit. See
    https://github.com/jeremylong/DependencyCheck/issues/5943
-->
<suppress>
   <notes><![CDATA[
   file name: org.eclipse.jgit-6.7.0.202309050840-r.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.jgit/org\.eclipse\.jgit@.*$</packageUrl>
   <cve>CVE-2023-4759</cve>
</suppress>

<!--
    These are FPs.
    See https://github.com/jeremylong/DependencyCheck/issues/5973
-->
<suppress>
    <packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus\-(cipher|classworlds|component-annotations|interpolation|container-default|sec-dispatcher)@.*$</packageUrl>
    <cve>CVE-2022-4244</cve>
    <cve>CVE-2022-4245</cve>
</suppress>

<!--
    False Positives. These CVEs are against the Brave web browser, not brave-opentracing.
-->
<suppress>
   <notes><![CDATA[
   file name: brave-opentracing-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.brave/brave\-opentracing@.*$</packageUrl>
   <cve>CVE-2022-47932</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: brave-opentracing-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.brave/brave\-opentracing@.*$</packageUrl>
   <cve>CVE-2022-47933</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: brave-opentracing-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.brave/brave\-opentracing@.*$</packageUrl>
   <cve>CVE-2022-47934</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: brave-opentracing-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.brave/brave\-opentracing@.*$</packageUrl>
   <cve>CVE-2021-22929</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: brave-opentracing-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.brave/brave\-opentracing@.*$</packageUrl>
   <cve>CVE-2022-30334</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: brave-opentracing-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.opentracing\.brave/brave\-opentracing@.*$</packageUrl>
   <cve>CVE-2023-28360</cve>
</suppress>

<!-- False Positives. This was identifying Helidon's dbclient mongodb support artifact with MongoDB itself
-->
<suppress>
   <notes><![CDATA[
   file name: io.helidon.dbclient:helidon-dbclient-mongodb:4.0.0-SNAPSHOT
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.helidon\.dbclient/helidon\-dbclient\-mongodb@.*$</packageUrl>
   <cpe>cpe:/a:mongodb:mongodb</cpe>
</suppress>

<!-- False Positives. This was identifying Helidon's mysql support artifact with MySQL itself
 -->
<suppress>
   <notes><![CDATA[
   file name: io.helidon.integrations.db:helidon-integrations-db-mysql:4.0.0-SNAPSHOT
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.helidon\.integrations\.db/helidon\-integrations\-db\-mysql@.*$</packageUrl>
   <cpe>cpe:/a:mysql:mysql</cpe>
</suppress>

<!-- False Positive.
     This is against an old version of prometheusa (not prometheus metrics nor micrometer)
 -->
<suppress>
   <notes><![CDATA[
   file name: micrometer-registry-prometheus-simpleclient-1.13.4.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.micrometer/micrometer-registry-prometheus-simpleclient@.*$</packageUrl>
   <cve>CVE-2019-3826</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: prometheus-metrics-core-1.2.1.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.prometheus/prometheus-metrics-(.*)@.*$</packageUrl>
   <cve>CVE-2019-3826</cve>
</suppress>

<!-- False Positives.
     This CVE is against the XML Database component of Oracle Database Server.
     The below are client libraries for XML and XML JDBC support.
-->

<suppress>
   <notes><![CDATA[
   file name: xdb-23.6.0.24.10.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.oracle\.database\.xml/xdb@.*$</packageUrl>
   <cve>CVE-2025-30694</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: xmlparserv2_sans_jaxp_services-23.6.0.24.10.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/com\.oracle\.database\.xml/xmlparserv2_sans_jaxp_services@.*$</packageUrl>
   <cve>CVE-2025-30694</cve>
</suppress>

<!-- False Positive.
     This CVE is against ChatGPT rendering of SVG images  not the openai4j API
-->
<suppress>
   <notes><![CDATA[
   file name: openai4j-0.23.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/dev\.ai4j/openai4j@.*$</packageUrl>
   <cve>CVE-2025-43714</cve>
</suppress>

<!-- False Positive.
     This CVE is against Nu Html Checker, not hibernate validator.
     https://github.com/dependency-check/DependencyCheck/issues/8249
-->
<suppress>
   <notes><![CDATA[
   file name: hibernate-validator-cdi-8.0.2.Final.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.hibernate\.validator/hibernate-validator-cdi@.*$</packageUrl>
   <cve>CVE-2025-15104</cve>
</suppress>

<!-- False Positive.
     This CVE is against Neo4J database, not the driver
-->
<suppress>
   <notes><![CDATA[
   file name: neo4j-java-driver-5.28.3.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.neo4j\.driver/neo4j-java-driver@.*$</packageUrl>
   <cve>CVE-2026-1337</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: neo4j-bolt-connection-1.0.0.jar
   file name: neo4j-bolt-connection-netty-1.0.0.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.neo4j\.bolt/neo4j-bolt-connection.*$</packageUrl>
   <cve>CVE-2026-1337</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   file name: io.helidon.integrations.neo4j:helidon-integrations-neo4j:4.4.0-SNAPSHOT
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.helidon\.integrations\.neo4j/helidon-integrations-neo4j.*$</packageUrl>
   <cve>CVE-2026-1337</cve>
</suppress>

<!-- 
     This CVE is old and was fixed in Kotlin 1.4.21. The CPE recently changed in NVD.
     Will keep an eye on this to see if the CPE in NVD is bad, or if there is something new.
-->
<suppress>
   <notes><![CDATA[
   file name: kotlin-stdlib-1.9.10.jar
   file name: kotlin-stdlib-jdk7-1.9.10.jar
   file name: kotlin-stdlib-jdk8-1.9.10.jar
   file name: kotlin-stdlib-common-1.9.10.jar
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib.*$</packageUrl>
   <cve>CVE-2020-29582</cve>
</suppress>

</suppressions>