diff --git a/airsonic-main/cve-suppressed.xml b/airsonic-main/cve-suppressed.xml
index 9a5c02a2..152e4de7 100644
--- a/airsonic-main/cve-suppressed.xml
+++ b/airsonic-main/cve-suppressed.xml
@@ -1,5 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
+
+    <!-- Provisional >> -->
+    <suppress>
+       <notes><![CDATA[False Positive for stax]]></notes>
+       <gav regex="true">^.*$</gav>
+       <cve>CVE-2018-1000840</cve>
+    </suppress>
+    <!-- << Provisional -->
+
     <suppress>
         <notes><![CDATA[RC4 vulnerability in ssl. We don't use ssl at the application container level]]></notes>
         <gav regex="true">^.*$</gav>