diff --git a/.trivyignore b/.trivyignore
index 3a32a838..0f4834dc 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -44,3 +44,16 @@ CVE-2026-66046 exp:2026-12-02
 # no libexpat added and no JNI/native XML path in any *.java
 # See: UID2-7801
 CVE-2026-76641 exp:2026-12-02
+
+# CVE-2026-76956 — libexpat (Alpine base-image OS library) (HIGH), DoS via hash flooding
+# attack with crafted XML.
+# Not exploitable here: this is a Java/Vert.x service that parses XML via JAXP/Xerces, not
+# libexpat; no JNI/native/subprocess path reaches it.
+# See: UID2-7849
+CVE-2026-76956 exp:2026-10-10
+
+# CVE-2026-76957 — libexpat (Alpine base-image OS library) (HIGH), memory corruption allowing
+# arbitrary code execution or DoS.
+# Not exploitable here: same reasoning as CVE-2026-76956 above.
+# See: UID2-7849
+CVE-2026-76957 exp:2026-10-10
diff --git a/pom.xml b/pom.xml
index a60d3c23..16d36c53 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@
         <junit-jupiter.version>5.11.2</junit-jupiter.version>
         <uid2-shared.version>11.7.4</uid2-shared.version>
         <okta-jwt.version>0.5.10</okta-jwt.version>
-        <netty.version>4.1.136.Final</netty.version>
+        <netty.version>4.1.137.Final</netty.version>
         <jackson.version>2.21.4</jackson.version>
         <image.version>${project.version}</image.version>
     </properties>