From 29d7e77a68a14eb3eeccff15e3a20cd4a951a445 Mon Sep 17 00:00:00 2001
From: sarthak77 <sarthak02singhal@gmail.com>
Date: Fri, 10 Apr 2026 08:36:05 +0530
Subject: [PATCH] Added suppression for CVE-2026-0994

AI-Session-Id: d5399cbf-6b5b-4725-b666-6b95cae0e012
AI-Tool: claude-code
AI-Model: unknown
---
 dependency-check/global-suppressions.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dependency-check/global-suppressions.xml b/dependency-check/global-suppressions.xml
index c75923d..c500fe2 100644
--- a/dependency-check/global-suppressions.xml
+++ b/dependency-check/global-suppressions.xml
@@ -141,6 +141,15 @@
     <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback-core@.*$</packageUrl>
     <vulnerabilityName>CVE-2024-12798</vulnerabilityName>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+   CVE-2026-0994 is a Python-only protobuf vulnerability affecting json_format.ParseDict.
+   This project uses Java protobuf (protobuf-java and protobuf-java-util), which do not
+   include the vulnerable Python code path. Hence this is a false positive.
+   ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.google\.protobuf/(protobuf\-java|protobuf\-java\-util)@.*$</packageUrl>
+    <cve>CVE-2026-0994</cve>
+  </suppress>
   <suppress>
    <notes><![CDATA[
    file name: micrometer-registry-prometheus-simpleclient-1.14.4.jar