From 983e0dc1ac5507629f2e4b8f960aa89a06f6d200 Mon Sep 17 00:00:00 2001
From: Varkeychan Jacob <varkey98@gmail.com>
Date: Mon, 3 Aug 2026 10:04:53 +0530
Subject: [PATCH] add suppression for prometheus related non java
 vulnerabilities

---
 dependency-check/global-suppressions.xml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/dependency-check/global-suppressions.xml b/dependency-check/global-suppressions.xml
index 0ab8d41..172963b 100644
--- a/dependency-check/global-suppressions.xml
+++ b/dependency-check/global-suppressions.xml
@@ -186,6 +186,29 @@
     <packageUrl regex="true">^pkg:maven/io\.prometheus/simpleclient.*@.*$</packageUrl>
     <cve>CVE-2026-42154</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+      CVE-2026-42154 affects the Prometheus server (Go binary), not Micrometer's Java
+      Prometheus registry. OWASP dependency-check incorrectly matches the Maven artifact
+      against cpe:2.3:a:prometheus:prometheus due to the shared "prometheus" name.
+      Ref: https://github.com/dependency-check/DependencyCheck/issues/8497
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/io\.micrometer/micrometer-registry-prometheus@.*$</packageUrl>
+    <cve>CVE-2026-42154</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+      These CVEs affect non-Java OpenTelemetry implementations (Go, .NET, and C++).
+      OWASP dependency-check incorrectly matches the Prometheus Java client's OTel
+      tracer bridge against cpe:2.3:a:opentelemetry:opentelemetry.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/io\.prometheus/prometheus-metrics-tracer-otel(-agent)?@.*$</packageUrl>
+    <cve>CVE-2026-41078</cve>
+    <cve>CVE-2026-39882</cve>
+    <cve>CVE-2026-40894</cve>
+    <cve>CVE-2026-41178</cve>
+    <cve>CVE-2026-44967</cve>
+  </suppress>
   <suppress>
     <notes><![CDATA[
    CVE-2026-42582 affects netty-codec-http3 which only exists in the Netty 4.2.x line.