diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index b83a96ae924c..957e7765733e 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -307,4 +307,12 @@
      ]]></notes>
     <cve>CVE-2017-15288</cve>
   </suppress>
+
+  <suppress>
+    <!-- (avro, parquet, integration-tests) we don't allow velocity templates to be uploaded by untrusted users -->
+    <notes><![CDATA[
+     file name: velocity-engine-core-2.2.jar:
+     ]]></notes>
+    <cve>CVE-2020-13936</cve>
+  </suppress>
 </suppressions>