Frankly, why have you decided to suppress it? If it's your dependency, you'll be transitively including it into any user consuming your library via classpath. There, it creates a (however unlikely) attack surface, since as long as it's loaded from classpath during runtime, a malicious actor might use an innocent-looking call to this deprecated method to e.g. create a backdoor that's mostly indistinguishable from normal code.

I agree that this is completely unlikely (mind me, even the base CVE has a very low severity rating by itself), but it's still possible and valid as a vulnerability, especially when coupled with other attack vectors.

TBH, since it's been confirmed by google/guava#6399 (comment) that they are working on an actual fix (i.e. removing the method or providing a safe fallback), wouldn't it be better if this wouldn't be suppressed at all and just wait for this to be closed at the source?