Merge pull request #412 from IABTechLab/bmz-UID2-7364-jackson-databind-cve

UID2-7364: Suppress CVE-2026-54512 / CVE-2026-54513 (jackson-databind)

Author: BehnamMozafari

.trivyignore

@@ -14,3 +14,11 @@ GHSA-72hv-8253-57qq exp:2026-09-01
 # LB-level connection limits and idle timeouts further cap the blast radius. CVSS impact is
 # Availability only (C:N/I:N/A:H). Tracking via UID2-7035; revisit on vert.x 5 migration.
 CVE-2026-42577 exp:2026-09-11
+
+# jackson-databind data-binding vulnerability - no upstream fix released yet (fix targets: 2.18.8, 2.21.4, 3.1.4)
+# jackson-databind is pulled in transitively via uid2-shared; the version fix is tracked in
+# uid2-shared (https://github.com/IABTechLab/uid2-shared/pull/631) and will flow here on the
+# next uid2-shared release. Suppressing in the interim.
+# See: UID2-7364
+CVE-2026-54512 exp:2026-07-25
+CVE-2026-54513 exp:2026-07-25