From 926439a9d3f2df9e2af2e33b06fd9ec1dac475f2 Mon Sep 17 00:00:00 2001
From: Adam Rauch <adam@labkey.com>
Date: Fri, 4 Sep 2026 13:46:22 -0700
Subject: [PATCH] Suppress reactor-netty CVE

---
 dependencyCheckSuppression.xml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index 1cab9c8187..75137d030f 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -507,4 +507,23 @@
         <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
     </suppress>
 
+    <!--
+    Azure Identity pulls in reactor-netty 1.2.18 which has DOS CVE-2026-47874. The Graph Email Transport isn't
+    deployed anywhere (yet) and medium-level DOS vulnerabilities have not been a big concern. Suppress for now,
+    until a newer Azure Identity that pulls in a fixed reactor-netty is available.
+    -->
+    <suppress>
+        <notes><![CDATA[
+    file name: reactor-netty-core-1.2.18.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.projectreactor\.netty/reactor-netty-core@.*$</packageUrl>
+        <cpe>cpe:/a:pivotal:reactor_netty</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: reactor-netty-http-1.2.18.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.projectreactor\.netty/reactor-netty-http@.*$</packageUrl>
+        <cpe>cpe:/a:pivotal:reactor_netty</cpe>
+    </suppress>
 </suppressions>