From de01790b60dbeb04f1b66268dc4823a439f701e7 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Wed, 2 Sep 2026 12:06:06 +1000 Subject: [PATCH] UID2-7800, UID2-7801: suppress 2 CVEs in .trivyignore (exp 2026-12-02) - CVE-2026-66046 (UID2-7800) - CVE-2026-76641 (UID2-7801) Each is present but not reachable from this service; see the linked tickets for the per-CVE impact assessments. Reachability alone determines suppress-vs-fix. --- .trivyignore | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.trivyignore b/.trivyignore index 0d88dad2..3a32a838 100644 --- a/.trivyignore +++ b/.trivyignore @@ -30,3 +30,17 @@ CVE-2026-42577 exp:2026-09-11 # /metrics; HTTP instrumentation via Vert.x, not micrometer-jetty/servlet binders # See: UID2-7662 CVE-2026-40984 exp:2026-11-11 + +# CVE-2026-66046 — libexpat (Alpine base-image OS library) (HIGH). +# Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; pure-Java Vert.x +# jar-with-dependencies. No loadLibrary/JNI/native XML refs in any src *.java; only XML on disk +# is trusted conf/logback.xml. JVM parses XML via JAXP/Xerces, not native libexpat. +# See: UID2-7800 +CVE-2026-66046 exp:2026-12-02 + +# CVE-2026-76641 — libexpat (Alpine base-image native C library) (HIGH). +# Not exploitable here: Dockerfile FROM eclipse-temurin@sha256:319339...(21-jre-alpine-3.23); +# pure-Java Vert.x jar-with-dependencies, apk adds only libpng/libcrypto3/libssl3/musl/gnutls; +# no libexpat added and no JNI/native XML path in any *.java +# See: UID2-7801 +CVE-2026-76641 exp:2026-12-02