From 07685b3ccde5876dbd6ae34ed35c0d5c715fbc38 Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Thu, 23 Jul 2026 04:04:49 +0000 Subject: [PATCH] UID2-7557: suppress jackson-core GHSA-r7wm-3cxj-wff9 (async parser, not reachable) Trivy flagged jackson-core GHSA-r7wm-3cxj-wff9 (HIGH) - an async-parser maxNumberLength bypass, the incomplete-fix successor to GHSA-72hv-8253-57qq. Our services parse JSON only via the synchronous ObjectMapper API, never jackson-core's non-blocking/async parser, so the vulnerable path is not reachable (same rationale as the already-suppressed predecessor, UID2-6670). A jackson bump is also in flight via uid2-shared PR #631. Suppress in .trivyignore with expiry 2026-08-23. Co-Authored-By: Claude Opus 4.8 (1M context) --- .trivyignore | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.trivyignore b/.trivyignore index 74f08dd5..232c21d3 100644 --- a/.trivyignore +++ b/.trivyignore @@ -48,3 +48,9 @@ CVE-2026-2100 exp:2026-09-01 CVE-2026-56131 exp:2026-08-09 CVE-2026-56407 exp:2026-08-09 CVE-2026-56408 exp:2026-08-09 + +# jackson-core async parser maxNumberLength bypass (GHSA-r7wm-3cxj-wff9) - incomplete fix for +# GHSA-72hv-8253-57qq. Not exploitable: services only use the synchronous ObjectMapper API, not +# jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared +# (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670) +GHSA-r7wm-3cxj-wff9 exp:2026-08-23