From 73f0e2e4017397bfdcf16b7e333c1279ada57c74 Mon Sep 17 00:00:00 2001
From: Stefan Miklosovic <smiklosovic@apache.org>
Date: Tue, 1 Apr 2025 13:03:24 +0200
Subject: [PATCH] Suppress CVE-2025-25193

patch by Stefan Miklosovic; reviewed by Michael Semb Wever, Brandon Williams for CASSANDRA-20504
---
 .build/dependency-check-suppressions.xml | 1 +
 .snyk                                    | 2 ++
 CHANGES.txt                              | 1 +
 3 files changed, 4 insertions(+)

diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 4cdcc9149c..70e1f87164 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -50,6 +50,7 @@
         <cve>CVE-2022-41881</cve>
         <cve>CVE-2023-34462</cve>
         <cve>CVE-2023-44487</cve>
+        <cve>CVE-2025-25193</cve>
     </suppress>
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-17966 -->
     <suppress>
diff --git a/.snyk b/.snyk
index 66d72fb74c..50af01c673 100644
--- a/.snyk
+++ b/.snyk
@@ -52,3 +52,5 @@ ignore:
     - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
   CVE-2024-12801:
     - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
+  CVE-2025-25193:
+    - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
diff --git a/CHANGES.txt b/CHANGES.txt
index a1d17c3e5f..da5ad11d3a 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 4.0.18
+ * Suppress CVE-2025-25193 (CASSANDRA-20504)
  * Include in source tree and build packages a Snyk policy file that lists known false positives (CASSANDRA-20319)
  * Update zstd-jni to 1.5.7-2 (CASSANDRA-20453)
  * Suppress CVE-2024-12801 (CASSANDRA-20412)