From 994b1025ed684e0b3f4f0e3d3a5ac2f0e1455f7f Mon Sep 17 00:00:00 2001
From: Kunal Kaushik <mrblazerebel@gmail.com>
Date: Tue, 6 Oct 2026 16:56:26 +0530
Subject: [PATCH] APPSEC-1202: Suppress CVE-2026-54285 false positive for
 prometheus tracer modules

OWASP dependency-check incorrectly maps OpenTelemetry CPE findings onto
io.prometheus prometheus-metrics-tracer-otel artifacts; add a scoped suppression.
---
 dependency-check/global-suppressions.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/dependency-check/global-suppressions.xml b/dependency-check/global-suppressions.xml
index bd8d869..e00a925 100644
--- a/dependency-check/global-suppressions.xml
+++ b/dependency-check/global-suppressions.xml
@@ -209,6 +209,15 @@
     <cve>CVE-2026-41178</cve>
     <cve>CVE-2026-44967</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+      False positive: dependency-check matches cpe:opentelemetry:opentelemetry (OpenTelemetry's
+      versioning, affected below 2.8.0) to the unrelated Prometheus Java client tracer modules;
+      observed on 1.3.5, 1.3.10 and 1.9.0.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/io\.prometheus/prometheus\-metrics\-tracer\-otel(\-agent)?@.*$</packageUrl>
+    <vulnerabilityName>CVE-2026-54285</vulnerabilityName>
+  </suppress>
   <suppress>
     <notes><![CDATA[
    CVE-2026-42582 and CVE-2026-56816 affect netty-codec-http3 which only exists in the