dm.ai/dependency-check-suppressions.xml at main · epam/dm.ai · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">

    <!-- GraalVM bundles ICU4J for JS unicode support; OWASP matches browser/C++ ICU CVEs -->
    <suppress>
        <notes><![CDATA[
            False positive: Chromium/ICU tooling CVEs (genrb, V8, etc.) are not applicable to
            org.graalvm.shadowed:icu4j used as a Java unicode library inside GraalVM JS.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.graalvm\.shadowed/icu4j@.*$</packageUrl>
        <cvssBelow>10</cvssBelow>
    </suppress>

    <suppress>
        <notes><![CDATA[
            False positive: CVE-2015-5922 (CVSS 10) is a Chromium/V8 ICU issue, not GraalVM icu4j.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.graalvm\.shadowed/icu4j@.*$</packageUrl>
        <cve>CVE-2015-5922</cve>
    </suppress>

    <!-- CVE description explicitly references gRPC-Go server authorization bypass -->
    <suppress>
        <notes><![CDATA[
            False positive: CVE-2026-33186 documents a gRPC-Go server :path validation bug,
            not the Java io.grpc:grpc-context artifact.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-context@.*$</packageUrl>
        <cve>CVE-2026-33186</cve>
    </suppress>

    <!-- CVE description explicitly references Python protobuf json_format.ParseDict -->
    <suppress>
        <notes><![CDATA[
            False positive: CVE-2026-0994 affects Python google.protobuf.json_format.ParseDict(),
            not Java com.google.protobuf:protobuf-java.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf-java@.*$</packageUrl>
        <cve>CVE-2026-0994</cve>
    </suppress>

    <suppress>
        <notes><![CDATA[
            False positive: CVE-2026-0994 affects Python google.protobuf.json_format.ParseDict(),
            not Java com.google.protobuf:protobuf-java-util.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf-java-util@.*$</packageUrl>
        <cve>CVE-2026-0994</cve>
    </suppress>

    <!-- Kotlin stdlib CVE is annotation-processor transitive; temp-dir perms, not runtime attack surface -->
    <suppress>
        <notes><![CDATA[
            False positive / accepted risk: CVE-2020-29582 is insecure temp-file creation in old Kotlin
            versions pulled only via Dagger/KSP annotation processors at build time.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
        <cve>CVE-2020-29582</cve>
    </suppress>

    <!-- Path traversal in ExtractEmbeddedFiles example code; dmtools does not use that example -->
    <suppress>
        <notes><![CDATA[
            False positive for dmtools: CVE-2026-23907/CVE-2026-33929 affect the PDFBox
            ExtractEmbeddedFiles sample, not core Loader.loadPDF usage in ReadPDFFile.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.pdfbox/.*@.*$</packageUrl>
        <cve>CVE-2026-23907</cve>
    </suppress>

    <suppress>
        <notes><![CDATA[
            False positive for dmtools: CVE-2026-33929 affects the PDFBox ExtractEmbeddedFiles sample.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.pdfbox/.*@.*$</packageUrl>
        <cve>CVE-2026-33929</cve>
    </suppress>

    <!-- KSP API matched to unrelated "processing" CPE; annotation processor only -->
    <suppress>
        <notes><![CDATA[
            False positive: CVE-2018-1000840 is for npm "morgan" package, not KSP symbol-processing-api.
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/com\.google\.devtools\.ksp/symbol-processing-api@.*$</packageUrl>
        <cve>CVE-2018-1000840</cve>
    </suppress>

</suppressions>