release: Suppress CVEs that are not applicable to Druid 38 by kfaraz · Pull Request #20335 · apache/druid

kfaraz · 2026-09-14T09:37:44Z

Created a separate PR for 38 branch since the master PR #20236 seems to have become a rabbit hole.

This PR has:

Copilot

🟡 Changes recommended

Critical applicability and suppression-scoping issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds Druid 38-specific OWASP Dependency-Check suppressions for CVEs considered inapplicable or false positives.

Changes:

Adds suppressions for Netty, Azure, UUID, zstd, Hadoop, HTTP, and other dependencies.
Documents rationale for dependency- and path-specific exceptions.

File summaries

File	Summary
`owasp-dependency-check-suppressions.xml`	Adds CVE suppression rules; several rules and rationales require correction or narrower scoping.

Review details

Suppressed comments (5)

owasp-dependency-check-suppressions.xml:310

The accepted trusted-peer risk is real, but this explanation says the CVE prerequisites are absent. Druid's Netty 3 HttpClientCodec can complete on an interim 103 and return the pooled channel before the final response, so this should be documented as an accepted Druid-to-Druid exposure (and tracked) rather than as an unaffected implementation.

    <cve>CVE-2026-42584</cve> <!-- Druid uses Netty3 for internal communication only, which does not satisfy any of the prerequisites of this vulnerability (pipeline requests, send HEAD, use 1xx responses) -->

owasp-dependency-check-suppressions.xml:941

The Dependency-Check paths are reported as hadoop-client-runtime-3.5.0.jar/META-INF/maven/org.eclipse.jetty/.../pom.xml, without a directory prefix. This leading .*/ therefore prevents the rule from matching, so the two Jetty CVEs remain reported. Make the prefix optional.

    <filePath regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.eclipse\.jetty[^/]*/[^/]*/pom\.xml$</filePath>

owasp-dependency-check-suppressions.xml:953

The Dependency-Check path is reported as hadoop-client-runtime-3.5.0.jar/META-INF/maven/org.jline/jline/pom.xml, without a directory prefix. This leading .*/ prevents the rule from matching, so CVE-2026-56740 and CVE-2026-56741 remain reported. Make the prefix optional.

    <filePath regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.jline/jline[^/]*/pom\.xml$</filePath>

owasp-dependency-check-suppressions.xml:871

The notes identify only the direct uuid@7.0.3 package, but this regex suppresses the advisory for every UUID version in the lockfile, including nested uuid@8.3.2 copies. That can hide the finding for a different dependency whose vulnerable API is exercised. Match the audited package version explicitly.

    <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>

owasp-dependency-check-suppressions.xml:905

This justification is contradicted by the Iceberg extension: HiveIcebergCatalog constructs org.apache.iceberg.hive.HiveCatalog and initializes it with catalogUri, and the extension includes hive-metastore at runtime. Druid does not embed a Hive server, but it can connect to a remote Hive Metastore; please make that server-versus-client boundary explicit rather than claiming Druid does not connect to one.

         All three affect Apache Hive server components (Metastore, HiveServer2).
         Druid uses hive-storage-api only for the Murmur3 hash utility
         (BloomKFilter.java) and ORC/Parquet column type definitions — it does not
         run or connect to a Hive Metastore or HiveServer2. -->

Files reviewed: 1/1 changed files
Comments generated: 7
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    <cve>CVE-2026-42584</cve> <!-- Druid uses Netty3 for internal communication only, which does not satisfy any of the prerequisites of this vulnerability (pipeline requests, send HEAD, use 1xx responses) -->
+    <cve>CVE-2026-46340</cve> <!-- We don't use SCTP transport; Druid uses TCP/NIO -->
+    <cve>CVE-2026-42583</cve> <!-- We don't use Netty's Lz4FrameDecoder; Druid uses lz4-java directly -->
+    <cve>CVE-2026-48043</cve> <!-- We don't use netty-codec-http2 directly; Druid's HTTP/2 is served by Jetty -->


+      file name: netty-codec-protobuf-4.2.15.Final.jar netty-transport-4.2.15.Final.jar (and other netty-*.jar at 4.2.x)
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/io\.netty/netty-.*@4\.2\..*$</packageUrl>
+    <cve>CVE-2026-56819</cve> <!-- HTTP/2 decompressor ByteBuf leak: Druid does not run a Netty 4.x HTTP/2 server -->


+      file name: async-http-client-3.0.2.jar
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.asynchttpclient/async-http-client@3.0.2$</packageUrl>
+    <cve>CVE-2026-45300</cve> <!-- Cookie leak on cross-origin redirect: Druid does not configure automatic redirect following or a cookie store in AHC; redirects are handled manually at application level in ServiceClientImpl without forwarding cookies -->


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

Unresolved suppression correctness and security reachability issues must be addressed.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (8)

owasp-dependency-check-suppressions.xml:953

This has the same root-path mismatch as the Jetty rule: .*/ requires a directory before hadoop-client-runtime, while the scanner reports hadoop-client-runtime-3.5.0.jar/META-INF/maven/org.jline/jline/pom.xml from the archive root. As written, the JLine CVEs are not suppressed and the check can still fail. Make the prefix optional.

    <filePath regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.jline/jline[^/]*/pom\.xml$</filePath>

owasp-dependency-check-suppressions.xml:331

The gRPC query extension is itself a Netty-based HTTP/2 server: QueryServer calls Grpc.newServerBuilderForPort, and its POM includes grpc-netty and netty-codec-http2. Therefore the HTTP/2 decompressor path covered by this CVE is reachable on Druid's gRPC endpoint; saying that Druid does not run a Netty 4.x HTTP/2 server is incorrect, and this blanket suppression can hide a real DoS. Scope the suppression away from the gRPC transport or verify and remediate that path instead.

    <cve>CVE-2026-56819</cve> <!-- HTTP/2 decompressor ByteBuf leak: Druid does not run a Netty 4.x HTTP/2 server -->

owasp-dependency-check-suppressions.xml:328

The 38 branch resolves netty4.version to 4.2.17.Final (pom.xml:114), not 4.2.15.Final. Since this note is the audit record for a security suppression, the recorded artifact version should match the version actually checked.

      file name: netty-codec-protobuf-4.2.15.Final.jar netty-transport-4.2.15.Final.jar (and other netty-*.jar at 4.2.x)

owasp-dependency-check-suppressions.xml:880

The 38 branch's dependency management resolves kotlin-stdlib to 2.2.21 (pom.xml:445-447), while this suppression note records 2.4.10. Please correct the audit note and recheck the rationale against the version actually scanned.

      file name: kotlin-stdlib-2.4.10.jar

owasp-dependency-check-suppressions.xml:907

This branch resolves hive-storage-api to 2.8.1 (pom.xml:637-640), not 4.2.0. Because the suppression rationale is version-specific, recording the newer branch's jar makes the security review/audit trail inaccurate; update the note and verify the rationale for 2.8.1.

      file name: hive-storage-api-4.2.0.jar

owasp-dependency-check-suppressions.xml:923

The 38 branch uses Parquet 1.16.0 (pom.xml:87), but this note names parquet-jackson-1.18.0. The file-path suppression is broad enough to cover the actual jar, so this stale version can make the CVE analysis appear to have covered a different artifact; update the note after confirming the embedded Jackson version in 1.16.0.

      file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind 2.18.6)
                 parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)

owasp-dependency-check-suppressions.xml:982

The Docker Java BOM in this branch is 3.7.0 (pom.xml:1308-1312), while this note records docker-java-transport-zerodep-3.7.1.jar. Since the suppression rationale depends on the shaded HttpComponents versions, update the note and verify it against the resolved 3.7.0 jar.

      file name: docker-java-transport-zerodep-3.7.1.jar (shaded httpclient5 5.5.1 and httpcore5 5.3.6)

owasp-dependency-check-suppressions.xml:905

The statement that Druid does not run or connect to a Hive Metastore is false: the Iceberg extension exposes HiveIcebergCatalog, constructs org.apache.iceberg.hive.HiveCatalog, and initializes it with the configured metastore URI. This suppression may still be valid specifically for hive-storage-api, but it needs an artifact-level justification that the affected classes are absent rather than the unsupported claim that the supported Hive catalog path is unreachable.

         All three affect Apache Hive server components (Metastore, HiveServer2).
         Druid uses hive-storage-api only for the Murmur3 hash utility
         (BloomKFilter.java) and ORC/Parquet column type definitions — it does not
         run or connect to a Hive Metastore or HiveServer2. -->

Files reviewed: 1/1 changed files
Comments generated: 3
Review effort level: Lite

+         Druid does not call org.xerial.snappy directly; snappy-java is a transitive dependency
+         (pulled in by Kafka, Parquet, etc.). Druid's own snappy decompression uses Apache Commons
+         Compress (FramedSnappyCompressorInputStream), not the xerial Snappy.uncompress path.
+         The vulnerable ByteBuffer overload is therefore not reachable from Druid code. -->


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…Druid) CVE-2026-73334 affects org.apache.parquet.crypto.keytools — a KMS URL validation bypass that can redirect token requests to a malicious host. Druid does not use Parquet's envelope encryption or KmsClient integration, so the vulnerable code path is unreachable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

kfaraz · 2026-09-17T08:02:50Z

Addressing the final set of CVEs now (obtained by using --fail-never flag):

[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
[ERROR] 
[ERROR] postgresql-42.7.11.jar (pkg:maven/org.postgresql/postgresql@42.7.11, cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.7.11:*:*:*:*:*:*:*): CVE-2026-54291(8.2)
[ERROR] proton-j-0.34.1.jar (pkg:maven/org.apache.qpid/proton-j@0.34.1, cpe:2.3:a:apache:qpid:0.34.1:*:*:*:*:*:*:*, cpe:2.3:a:apache:qpid_proton:0.34.1:*:*:*:*:*:*:*, cpe:2.3:a:apache:qpid_proton-j:0.34.1:*:*:*:*:*:*:*, cpe:2.3:a:proton_project:proton:0.34.1:*:*:*:*:*:*:*): CVE-2026-66273(7.5), CVE-2026-66274(7.5), CVE-2026-66257(7.5)
[ERROR] ranger-audit-core-2.8.0.jar (pkg:maven/org.apache.ranger/ranger-audit-core@2.8.0, cpe:2.3:a:apache:ranger:2.8.0:*:*:*:*:*:*:*): CVE-2026-65948(7.3), CVE-2026-28672(9.8), CVE-2026-44416(9.8), CVE-2026-55799(9.8), CVE-2026-65942(7.5), CVE-2026-40920(9.8), CVE-2026-42537(9.8), CVE-2026-55814(7.5), CVE-2026-32227(9.8)
[ERROR] ranger-plugin-classloader-2.8.0.jar (pkg:maven/org.apache.ranger/ranger-plugin-classloader@2.8.0, cpe:2.3:a:apache:ranger:2.8.0:*:*:*:*:*:*:*, cpe:2.3:a:apache-ssl:apache-ssl:2.8.0:*:*:*:*:*:*:*): CVE-2026-65948(7.3), CVE-2026-28672(9.8), CVE-2026-44416(9.8), CVE-2026-55799(9.8), CVE-2026-65942(7.5), CVE-2026-40920(9.8), CVE-2026-42537(9.8), CVE-2026-55814(7.5), CVE-2026-32227(9.8)
[ERROR] ugsync-util-2.8.0.jar (pkg:maven/org.apache.ranger/ugsync-util@2.8.0, cpe:2.3:a:apache:ranger:2.8.0:*:*:*:*:*:*:*): CVE-2026-65948(7.3), CVE-2026-28672(9.8), CVE-2026-44416(9.8), CVE-2026-55799(9.8), CVE-2026-65942(7.5), CVE-2026-40920(9.8), CVE-2026-42537(9.8), CVE-2026-55814(7.5), CVE-2026-32227(9.8)

kfaraz · 2026-09-17T11:34:30Z

Upgrading the final set of libs here:
#20369

Copilot

🟡 Changes recommended

The security scan can become non-gating, and multiple suppression rules require narrower scope or corrected rationale.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

owasp-dependency-check-suppressions.xml:331

This suppresses CVE-2026-56819 for every Netty 4.2 artifact, but grpc-query declares netty-codec-http2/grpc-netty and starts a gRPC server with Grpc.newServerBuilderForPort (extensions-contrib/grpc-query/src/main/java/org/apache/druid/grpc/server/QueryServer.java:76). That is a Netty HTTP/2 server path, contrary to the rationale here, so the exception can hide a reachable finding when this supported extension is enabled. Remove this CVE from the blanket suppression or scope it only to components not used by grpc-query.

    <cve>CVE-2026-56819</cve> <!-- HTTP/2 decompressor ByteBuf leak: Druid does not run a Netty 4.x HTTP/2 server -->

Files reviewed: 2/2 changed files
Comments generated: 3
Review effort level: Lite

+         Druid uses hive-storage-api only for the Murmur3 hash utility
+         (BloomKFilter.java) and ORC/Parquet column type definitions — it does not
+         run or connect to a Hive Metastore or HiveServer2. -->


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

… client CVE-2026-79993: deleteContainer ACL bypass (ZK server-side, fixed in 3.8.7) CVE-2026-59739: SetWatches reconnect replay leaks path names (ZK server-side, fixed in 3.8.7) CVE-2026-59969: quorum TLS hostname bypass in FIPS mode (server-to-server only, fixed in 3.8.7) Druid uses ZooKeeper as a client only and does not run a ZK server or quorum, so none of these code paths are reachable from Druid. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Suppress CVEs that are not applicable to Druid

bf5de82

kfaraz changed the title ~~ci: Suppress CVEs that are not applicable to Druid~~ release: Suppress CVEs that are not applicable to Druid Sep 14, 2026

Merge branch '38.0.0' of github.com:apache/druid into 38.0.0-fix-cves

9380803

kfaraz changed the title ~~release: Suppress CVEs that are not applicable to Druid~~ release: Suppress CVEs that are not applicable to Druid 38 Sep 14, 2026

A few more CVEs remaining in this branch

bd7681e

kfaraz requested a lite review from Copilot September 14, 2026 16:16

Copilot started reviewing on behalf of kfaraz September 14, 2026 16:19

View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

kfaraz and others added 2 commits September 15, 2026 11:33

Apply batched suggestions from code review

e58a48e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

a730454

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

kfaraz added this to the 38.0.0 milestone Sep 15, 2026

kfaraz added 4 commits September 15, 2026 21:27

Merge branch '38.0.0' of github.com:apache/druid into 38.0.0-fix-cves

f19e43b

Merge branch '38.0.0' of github.com:apache/druid into 38.0.0-fix-cves

4f536ad

Suppress snappy CVE

bb3811b

Merge branch '38.0.0' of github.com:apache/druid into 38.0.0-fix-cves

bce18e5

kfaraz requested a lite review from Copilot September 16, 2026 12:14

Copilot started reviewing on behalf of kfaraz September 16, 2026 12:15

View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

kfaraz and others added 3 commits September 17, 2026 08:16

Potential fix for pull request finding

d428487

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

fea95da

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Add --fail-never so that all modules are scanned

13755d1

github-actions Bot added the GHA label Sep 17, 2026

Merge branch '38.0.0' of github.com:apache/druid into 38.0.0-fix-cves

235b742

kfaraz requested a lite review from Copilot September 17, 2026 17:46

Copilot started reviewing on behalf of kfaraz September 17, 2026 17:46

View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

FrankChen021 mentioned this pull request Sep 18, 2026

Flaky test Triage - 2026-09-18 #20378

Closed

kfaraz and others added 3 commits September 18, 2026 09:28

Potential fix for pull request finding

8062ec6

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Fix up stuff

c5c7abf

Broaden parquet CVE-2026-73334 suppression

e5ba9b9

cryptoe approved these changes Sep 18, 2026

View reviewed changes

This was referenced Sep 19, 2026

Flaky test Triage - 2026-09-19 #20385

Closed

Flaky test Triage - 2026-09-21 #20389

Closed

kfaraz and others added 3 commits September 21, 2026 11:26

Include jute

8d5e188

Revert extra change

955759e

kfaraz merged commit 5f2587d into 38.0.0 Sep 21, 2026
34 of 35 checks passed

kfaraz deleted the 38.0.0-fix-cves branch September 21, 2026 18:31

Navigation Menu

Repository navigation

release: Suppress CVEs that are not applicable to Druid 38 - #20335

release: Suppress CVEs that are not applicable to Druid 38#20335
kfaraz merged 20 commits into
38.0.0from
38.0.0-fix-cves

kfaraz commented Sep 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

kfaraz commented Sep 17, 2026 •

edited

Loading

Uh oh!

kfaraz commented Sep 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kfaraz commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (5)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (8)

Uh oh!

Uh oh!

Uh oh!

kfaraz commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kfaraz commented Sep 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kfaraz commented Sep 14, 2026 •

edited

Loading

kfaraz commented Sep 17, 2026 •

edited

Loading