# Trivy CVE ignore file — DocuVault
# Each entry is a CVE ID that is accepted with documented rationale.
# Reviewed: 2026-06-04

# CVE-2026-40393 — Mesa out-of-bounds memory access (libgbm1, libgl1-mesa-dri, libglx-mesa0, mesa-libgallium)
# Status: will_not_fix (Debian)
# Rationale: Mesa GPU rendering libraries are pulled in as dependencies of libgl1 (required by
#   PyMuPDF for PDF text extraction). In a headless server container, no GPU rendering is ever
#   performed — the vulnerable GPU code paths are never invoked. Debian has reviewed this CVE
#   and chosen not to fix it in the current release (will_not_fix). Re-evaluate when a fix
#   becomes available or when libgl1 can be replaced with a GPU-stub alternative.
CVE-2026-40393

# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks (perl-base)
# Status: affected, no fix available
# Rationale: perl-base is a mandatory component of the python:3.12-slim base image (Debian 13).
#   It cannot be removed without rebuilding the base image. No patched version exists upstream.
#   The vulnerability requires an attacker to supply a crafted tar archive to perl-archive-tar;
#   DocuVault never processes tar archives via perl. Re-evaluate when Debian ships a patch.
CVE-2026-42496

# CVE-2026-8376 — Perl heap buffer overflow when compiling (perl-base)
# Status: affected, no fix available
# Rationale: Same as CVE-2026-42496. No fix available in Debian 13. The vulnerable code path
#   (Perl regex compilation) is never invoked by DocuVault's Python runtime. Re-evaluate
#   when Debian ships a patch.
CVE-2026-8376