From 9ebfbf0a18019a82c87901db13ed17c9a0f3ebdc Mon Sep 17 00:00:00 2001 From: sophia chen Date: Wed, 28 Oct 2026 14:26:21 +1100 Subject: [PATCH 1/2] UID2-8185: suppress CVE-2026-75595 in .trivyignore (not affected) Co-Authored-By: Claude Sonnet 5.5 --- .trivyignore | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.trivyignore b/.trivyignore index 95aa9b7d..64e3a439 100644 --- a/.trivyignore +++ b/.trivyignore @@ -5,3 +5,7 @@ # jackson-core async parser DoS - not exploitable, services only use synchronous ObjectMapper API # See: UID2-6670 GHSA-72hv-8253-57qq exp:2026-09-01 + +# CVE-2026-75595 — netty-handler (CRITICAL). Not vulnerable. +# See: UID2-8185 +CVE-2026-75595 exp:2027-04-28 From e1cc0ae607a0d2b12a2801966bda042bbed5ca99 Mon Sep 17 00:00:00 2001 From: sophia chen Date: Wed, 28 Oct 2026 16:15:28 +1100 Subject: [PATCH 2/2] UID2-8185, UID2-8215: suppress 3 CVEs in .trivyignore (not affected) Co-Authored-By: Claude Sonnet 5.5 --- .trivyignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.trivyignore b/.trivyignore index 64e3a439..54ccfeff 100644 --- a/.trivyignore +++ b/.trivyignore @@ -9,3 +9,11 @@ GHSA-72hv-8253-57qq exp:2026-09-01 # CVE-2026-75595 — netty-handler (CRITICAL). Not vulnerable. # See: UID2-8185 CVE-2026-75595 exp:2027-04-28 + +# CVE-2026-102554 — guava (HIGH). Not vulnerable. +# See: UID2-8215 +CVE-2026-102554 exp:2027-04-28 + +# CVE-2026-40984 — micrometer-core (HIGH). Not vulnerable. +# See: UID2-8215 +CVE-2026-40984 exp:2027-04-28