Suppress new Netty and Spring CVEs pending upstream fixes

CVE-2026-42582 (Netty 4.1.134.Final) and CVE-2026-41840/41841/41842/41843/41850/41851
(Spring Framework 6.2.18 via spring-boot-dependencies:3.5.14) have no fixed release yet.
Suppressed temporarily to unblock CI; a follow-up PR will bump the dependencies once
fixed versions are available.

Author: thibauult

allow-list.xml

@@ -39,4 +39,26 @@
         <vulnerabilityName>GHSA-7rx3-28cr-v5wh</vulnerabilityName>
         <vulnerabilityName>GHSA-442j-39wm-28r2</vulnerabilityName>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+          CVE-2026-42582 affects Netty 4.1.134.Final. No fixed release available yet.
+          Tracked for resolution via a dependency upgrade PR.
+          ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.netty/.*@.*$</packageUrl>
+        <cve>CVE-2026-42582</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+          CVE-2026-41840 through CVE-2026-41851 affect Spring Framework 6.2.18, pulled in via
+          spring-boot-dependencies:3.5.14. No fixed Spring Boot 3.5.x release available yet.
+          Tracked for resolution via a dependency upgrade PR.
+          ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.springframework/.*@.*$</packageUrl>
+        <cve>CVE-2026-41840</cve>
+        <cve>CVE-2026-41841</cve>
+        <cve>CVE-2026-41842</cve>
+        <cve>CVE-2026-41843</cve>
+        <cve>CVE-2026-41850</cve>
+        <cve>CVE-2026-41851</cve>
+    </suppress>
 </suppressions>