diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml
index 2cb82677db087..d5ddc28e884cb 100644
--- a/src/owasp-dependency-check-suppressions.xml
+++ b/src/owasp-dependency-check-suppressions.xml
@@ -109,7 +109,15 @@
         <sha1>b87878db57d5cfc2ca7d3972cc8f7486bf02fbca</sha1>
         <cve>CVE-2020-8908</cve>
     </suppress>
-
+    <suppress>
+        <notes><![CDATA[
+    file name: canal.client-1.1.5.jar (shaded: com.google.guava:guava:32.1.1)
+    CVE cannot take effect.
+    Already covered by PR https://github.com/apache/pulsar/pull/20699
+    ]]></notes>
+        <sha1>b87878db57d5cfc2ca7d3972cc8f7486bf02fbca</sha1>
+        <cve>CVE-2023-2976</cve>
+    </suppress>
     <!-- clickhouse: security scan matches client lib to the server CVEs -->
     <suppress>
         <notes><![CDATA[
@@ -181,6 +189,15 @@
         <sha1>fa9a1ccda7d78edb51a3a33d3493566092786a30</sha1>
         <cve>CVE-2021-25263</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: clickhouse-jdbc-0.4.6-all.jar (shaded: com.google.guava:guava:32.1.1)
+    CVE cannot take effect.
+    Already covered by PR https://github.com/apache/pulsar/pull/20699
+    ]]></notes>
+        <sha1>d3b929509399a698915b24ff47db781d0c526760</sha1>
+        <cve>CVE-2023-2976</cve>
+    </suppress>
     <suppress>
         <notes><![CDATA[
      file name: logback-core-1.1.3.jar