From 70953039bd0db7e3d7d76363af7d43d7ae1a384f Mon Sep 17 00:00:00 2001
From: Aaron Steinfeld <aaron.steinfeld@harness.io>
Date: Tue, 19 May 2026 09:04:14 -0400
Subject: [PATCH] Add suppression for CVE-2026-42582 in global suppressions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AI-Session-Id: 12fb583a-084c-4e08-9ec8-2ea46a2e79eb
AI-Tool: claude-code
AI-Model: unknown
---
 dependency-check/global-suppressions.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dependency-check/global-suppressions.xml b/dependency-check/global-suppressions.xml
index 84e0d52..0ab8d41 100644
--- a/dependency-check/global-suppressions.xml
+++ b/dependency-check/global-suppressions.xml
@@ -186,4 +186,13 @@
     <packageUrl regex="true">^pkg:maven/io\.prometheus/simpleclient.*@.*$</packageUrl>
     <cve>CVE-2026-42154</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+   CVE-2026-42582 affects netty-codec-http3 which only exists in the Netty 4.2.x line.
+   The 4.1.x line does not include HTTP/3 support. False positive due to shared CPE.
+   Advisory: https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw
+   ]]></notes>
+    <packageUrl regex="true">^pkg:maven/io\.netty/(?!netty\-codec\-http3).*@.*$</packageUrl>
+    <cve>CVE-2026-42582</cve>
+  </suppress>
 </suppressions>