{
  "@id": "urn:uuid:4066197e-cdcc-4c9f-80b1-426359f4d82e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:26:00.096253+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.11.1-tuxcare.4 is significantly newer and contains the upstream fix. The vulnerability allows remote code execution through deserialization of dangerous classes. The fix (issue #1737) adds java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and related Spring/C3P0 classes to a blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.11.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.11.1-tuxcare.4 is significantly newer and contains the upstream fix. The vulnerability allows remote code execution through deserialization of dangerous classes. The fix (issue #1737) adds java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and related Spring/C3P0 classes to a blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.11.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.11.1 already contains the complete fix (SubTypeValidator with blacklist and Spring/C3P0 hierarchy checking) which shipped in the upstream release. The fix commit (2235894210c7) was authored by upstream maintainer Tatu Saloranta on 2017-12-18, over 2.5 years before the 2.11.1 release (2020-06-24). The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.11.1 already contains the complete fix (SubTypeValidator with blacklist and Spring/C3P0 hierarchy checking) which shipped in the upstream release. The fix commit (2235894210c7) was authored by upstream maintainer Tatu Saloranta on 2017-12-18, over 2.5 years before the 2.11.1 release (2020-06-24). The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target repository is version 2.11.1, which already contains the upstream vendor's fix for this vulnerability. The fix (commit 60d459cedc) was authored by Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.11.1. The defense mechanism (SubTypeValidator) blocks deserialization of dangerous classes including TemplatesImpl, preventing the arbitrary code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target repository is version 2.11.1, which already contains the upstream vendor's fix for this vulnerability. The fix (commit 60d459cedc) was authored by Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.11.1. The defense mechanism (SubTypeValidator) blocks deserialization of dangerous classes including TemplatesImpl, preventing the arbitrary code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2018-11307. The vulnerability involved deserialization of the iBatis XPathParser gadget class leading to data exfiltration via XML external entities. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was already present in the upstream 2.11.1 release before TuxCare onboarded this version. The blacklist entry exists at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:65. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 27b4defc27, which predates TuxCare's onboarding commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "Target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2018-11307. The vulnerability involved deserialization of the iBatis XPathParser gadget class leading to data exfiltration via XML external entities. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was already present in the upstream 2.11.1 release before TuxCare onboarded this version. The blacklist entry exists at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:65. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 27b4defc27, which predates TuxCare's onboarding commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability required specific gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to be available for polymorphic deserialization when Default Typing is enabled. The upstream fix added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.11.1 (released May 2020), which TuxCare later onboarded. The target contains the complete fix at SubTypeValidator.java lines 67-72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability required specific gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to be available for polymorphic deserialization when Default Typing is enabled. The upstream fix added these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.11.1 (released May 2020), which TuxCare later onboarded. The target contains the complete fix at SubTypeValidator.java lines 67-72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, involving polymorphic deserialization of Oracle JDBC classes that enable JNDI/LDAP injection attacks leading to RCE. The target version 2.11.1-tuxcare.4 is not affected because the upstream vendor (FasterXML) already fixed this vulnerability before the 2.11.1 release. The fix blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java (lines 70-72), preventing their polymorphic deserialization when Default Typing is enabled. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 28badf7ef6 and was part of the upstream 2.11.1 release that TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, involving polymorphic deserialization of Oracle JDBC classes that enable JNDI/LDAP injection attacks leading to RCE. The target version 2.11.1-tuxcare.4 is not affected because the upstream vendor (FasterXML) already fixed this vulnerability before the 2.11.1 release. The fix blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java (lines 70-72), preventing their polymorphic deserialization when Default Typing is enabled. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 28badf7ef6 and was part of the upstream 2.11.1 release that TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The vulnerability pattern is not present because the fix was already shipped in the upstream release 2.11.1. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 74-78, preventing their polymorphic deserialization. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 87d29af25e and was present in version 2.11.1 when TuxCare onboarded it. Since the CVE affects versions before 2.9.7 and the target is 2.11.1, the vulnerability never existed in this released version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target repository jackson-databind version 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The vulnerability pattern is not present because the fix was already shipped in the upstream release 2.11.1. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 74-78, preventing their polymorphic deserialization. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 87d29af25e and was present in version 2.11.1 when TuxCare onboarded it. Since the CVE affects versions before 2.9.7 and the target is 2.11.1, the vulnerability never existed in this released version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions that fail to blacklist BlazeDS classes from polymorphic deserialization. The target (jackson-databind 2.11.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.11.1 release that TuxCare onboarded. The blacklist entry \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" (from blaze-ds-opt/blaze-ds-core) is present in SubTypeValidator.java at line 76, blocking the attack vector. Fix commit 87d29af25e was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.11.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions that fail to blacklist BlazeDS classes from polymorphic deserialization. The target (jackson-databind 2.11.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.11.1 release that TuxCare onboarded. The blacklist entry \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" (from blaze-ds-opt/blaze-ds-core) is present in SubTypeValidator.java at line 76, blocking the attack vector. Fix commit 87d29af25e was authored by upstream maintainer Tatu Saloranta and shipped in the original 2.11.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks and code execution. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.11.1, which TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 75-78 and are enforced during deserialization via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that enable XXE attacks and code execution. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.11.1, which TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 75-78 and are enforced during deserialization via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2018-14721. The vulnerability (failure to block org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization) has been fixed by the upstream vendor. The fix was already present in upstream version 2.11.1 when TuxCare onboarded it. The malicious class is properly blocked in SubTypeValidator.java line 78 within the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing SSRF attacks via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2018-14721. The vulnerability (failure to block org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization) has been fixed by the upstream vendor. The fix was already present in upstream version 2.11.1 when TuxCare onboarded it. The malicious class is properly blocked in SubTypeValidator.java line 78 within the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing SSRF attacks via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version 2.11.1 already contains the upstream fix (commit 72cd4025a) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java:85. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release before TuxCare onboarded version 2.11.1. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version 2.11.1 already contains the upstream fix (commit 72cd4025a) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java:85. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release before TuxCare onboarded version 2.11.1. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves the ability to exploit openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) via polymorphic deserialization. The upstream fix adds these classes to a blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.11.1 that TuxCare onboarded (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta, 2018-11-19), making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves the ability to exploit openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) via polymorphic deserialization. The upstream fix adds these classes to a blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.11.1 that TuxCare onboarded (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta, 2018-11-19), making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.11.1. The vulnerability involves missing blacklist entries for dangerous classes (org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core) that could be exploited via polymorphic deserialization. The fix was already included in upstream jackson-databind 2.11.1 (released 2020-06-24) before TuxCare onboarded this version. The blacklist entry is present at SubTypeValidator.java:81, added by upstream commit 72cd4025a2 (authored by Tatu Saloranta, 2018-11-19), which predates the TuxCare onboarding commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.11.1. The vulnerability involves missing blacklist entries for dangerous classes (org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core) that could be exploited via polymorphic deserialization. The fix was already included in upstream jackson-databind 2.11.1 (released 2020-06-24) before TuxCare onboarded this version. The blacklist entry is present at SubTypeValidator.java:81, added by upstream commit 72cd4025a2 (authored by Tatu Saloranta, 2018-11-19), which predates the TuxCare onboarding commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2018-5968. The two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that enable RCE via deserialization are already present in the blacklist (SubTypeValidator.java lines 62-63). This fix was included in the upstream jackson-databind 2.11.1 release before TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2018-5968. The two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that enable RCE via deserialization are already present in the blacklist (SubTypeValidator.java lines 62-63). This fix was included in the upstream jackson-databind 2.11.1 release before TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 fix was already present in jackson-databind 2.11.1 upstream release before TuxCare onboarding. The target contains the complete defense in SubTypeValidator.java (lines 243-253) that blocks deserialization of any c3p0 DataSource classes matching the pattern \"com.mchange.v2.c3p0.*DataSource\". Fix commit 6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 authored by upstream maintainer tatu.saloranta@iki.fi was included in the upstream 2.11.1 release that TuxCare onboarded via commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 fix was already present in jackson-databind 2.11.1 upstream release before TuxCare onboarding. The target contains the complete defense in SubTypeValidator.java (lines 243-253) that blocks deserialization of any c3p0 DataSource classes matching the pattern \"com.mchange.v2.c3p0.*DataSource\". Fix commit 6799f8f10cc78e9af6d443ed6982d00a13f2e7d2 authored by upstream maintainer tatu.saloranta@iki.fi was included in the upstream 2.11.1 release that TuxCare onboarded via commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target repository is version 2.11.1-tuxcare.4, which already includes the upstream fix. The vulnerability involves polymorphic deserialization of the dangerous class com.mysql.cj.jdbc.admin.MiniAdmin when default typing is enabled. The fix (commit dda513bd by Tatu Saloranta on 2019-05-14) adds MiniAdmin to the blocklist in SubTypeValidator.java (line 88), preventing its deserialization. This fix was included in upstream version 2.9.9 and was already present when TuxCare onboarded version 2.11.1 (commit 2b01a105 on 2020-06-11). The target is not vulnerable because the dangerous class is explicitly blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target repository is version 2.11.1-tuxcare.4, which already includes the upstream fix. The vulnerability involves polymorphic deserialization of the dangerous class com.mysql.cj.jdbc.admin.MiniAdmin when default typing is enabled. The fix (commit dda513bd by Tatu Saloranta on 2019-05-14) adds MiniAdmin to the blocklist in SubTypeValidator.java (line 88), preventing its deserialization. This fix was included in upstream version 2.9.9 and was already present when TuxCare onboarded version 2.11.1 (commit 2b01a105 on 2020-06-11). The target is not vulnerable because the dangerous class is explicitly blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2019-12384. The vulnerability involves unsafe polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2019-12384. The vulnerability involves unsafe polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2019-12814. The vulnerability was fixed in upstream Jackson 2.9.9.1 (released June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist. This fix was already present in the upstream Jackson 2.11.1 release that TuxCare onboarded, so the vulnerable pattern does ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2019-12814. The vulnerability was fixed in upstream Jackson 2.9.9.1 (released June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist. This fix was already present in the upstream Jackson 2.11.1 release that TuxCare onboarded, so the vulnerable pattern does ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 does NOT affect jackson-databind 2.11.1-tuxcare.3. The vulnerability concerned missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via unsafe deserialization. The fix was already present in the upstream jackson-databind 2.11.1 release (commit ad418eeb by Tatu Saloranta on 2019-07-25), which predates TuxCare's onboarding. Both blacklist entries are present at SubTypeValidator.java lines 98 and 102, and the validation logic actively enforces these blocks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 does NOT affect jackson-databind 2.11.1-tuxcare.3. The vulnerability concerned missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via unsafe deserialization. The fix was already present in the upstream jackson-databind 2.11.1 release (commit ad418eeb by Tatu Saloranta on 2019-07-25), which predates TuxCare's onboarding. Both blacklist entries are present at SubTypeValidator.java lines 98 and 102, and the validation logic actively enforces these blocks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2019-14439. The vulnerability was fixed in the upstream release by FasterXML maintainer Tatu Saloranta (commit ad418eeb97, dated 2019-07-25), which added blacklist entries for dangerous logback and EHCache classes to SubTypeValidator.java. TuxCare onboarded version 2.11.1 which already contained this upstream fix. The target's SubTypeValidator.java contains both required blacklist entries: 'ch.qos.logback.core.db.JNDIConnectionSource' (line 102) and 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup' (line 98), preventing deserialization of these dangerous classes during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2019-14439. The vulnerability was fixed in the upstream release by FasterXML maintainer Tatu Saloranta (commit ad418eeb97, dated 2019-07-25), which added blacklist entries for dangerous logback and EHCache classes to SubTypeValidator.java. TuxCare onboarded version 2.11.1 which already contained this upstream fix. The target's SubTypeValidator.java contains both required blacklist entries: 'ch.qos.logback.core.db.JNDIConnectionSource' (line 102) and 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup' (line 98), preventing deserialization of these dangerous classes during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 via polymorphic deserialization of HikariConfig/HikariDataSource gadget classes. Target version 2.11.1-tuxcare.4 is not affected because the upstream vendor (FasterXML) already fixed this vulnerability in the 2.11.1 release that TuxCare onboarded. The fix adds com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blocklist, preventing their deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release 2.11.1 before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10/2.8.11.5/2.6.7.3 via polymorphic deserialization of HikariConfig/HikariDataSource gadget classes. Target version 2.11.1-tuxcare.4 is not affected because the upstream vendor (FasterXML) already fixed this vulnerability in the 2.11.1 release that TuxCare onboarded. The fix adds com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blocklist, preventing their deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release 2.11.1 before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2019-14892. The vulnerability allows arbitrary code execution via polymorphic deserialization of commons-configuration JNDI classes. The fix (blacklisting org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in the upstream jackson-databind 2.11.1 release and is confirmed present in SubTypeValidator.java lines 113-114. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "Target jackson-databind 2.11.1-tuxcare.4 is NOT affected by CVE-2019-14892. The vulnerability allows arbitrary code execution via polymorphic deserialization of commons-configuration JNDI classes. The fix (blacklisting org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in the upstream jackson-databind 2.11.1 release and is confirmed present in SubTypeValidator.java lines 113-114. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 (xalan JNDI gadget deserialization) is NOT present in jackson-databind 2.11.1-tuxcare.4. The fix (blocking org.apache.xalan.lib.sql.JNDIConnectionPool in SubTypeValidator) was already included in upstream release 2.11.1, authored by Tatu Saloranta on 2019-09-19. Target version 2.11.1 is after the CVE's affected range (before 2.9.10 and 2.10.0). The vulnerable gadget class is blocklisted at SubTypeValidator.java:117, preventing polymorphic deserialization of this JNDI-based RCE vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 (xalan JNDI gadget deserialization) is NOT present in jackson-databind 2.11.1-tuxcare.4. The fix (blocking org.apache.xalan.lib.sql.JNDIConnectionPool in SubTypeValidator) was already included in upstream release 2.11.1, authored by Tatu Saloranta on 2019-09-19. Target version 2.11.1 is after the CVE's affected range (before 2.9.10 and 2.10.0). The vulnerable gadget class is blocklisted at SubTypeValidator.java:117, preventing polymorphic deserialization of this JNDI-based RCE vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution. The fix (blocking HikariDataSource in SubTypeValidator) was already included in upstream jackson-databind 2.11.1, which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to arbitrary code execution. The fix (blocking HikariDataSource in SubTypeValidator) was already included in upstream jackson-databind 2.11.1, which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability affects versions 2.0.0 through 2.9.10, and the upstream fix (commit 9593e16cf5 by tatu.saloranta@iki.fi) was already present in upstream version 2.11.1 when TuxCare onboarded it. The three dangerous classes (PerUserPoolDataSource, SharedPoolDataSource, P6DataSource) are already in the SubTypeValidator deny list at lines 122-124, preventing polymorphic deserialization attacks. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability affects versions 2.0.0 through 2.9.10, and the upstream fix (commit 9593e16cf5 by tatu.saloranta@iki.fi) was already present in upstream version 2.11.1 when TuxCare onboarded it. The three dangerous classes (PerUserPoolDataSource, SharedPoolDataSource, P6DataSource) are already in the SubTypeValidator deny list at lines 122-124, preventing polymorphic deserialization attacks. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target version 2.11.1-tuxcare.4 already contains the upstream fix that adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the deserialization blacklist in SubTypeValidator.java (lines 121-124). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.11.1 release, which TuxCare later onboarded. The blacklist mechanism prevents deserialization of these gadget classes when polymorphic typing is enabled, blocking the attack chain from Input (JSON with type info) to Goal (gadget instantiation for code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target version 2.11.1-tuxcare.4 already contains the upstream fix that adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the deserialization blacklist in SubTypeValidator.java (lines 121-124). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.11.1 release, which TuxCare later onboarded. The blacklist mechanism prevents deserialization of these gadget classes when polymorphic typing is enabled, blocking the attack chain from Input (JSON with type info) to Goal (gadget instantiation for code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability relates to polymorphic deserialization of the class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (commit 191a4cdf87) adds this class to the blocklist in SubTypeValidator.java and was included in the upstream jackson-databind 2.11.1 release. The target version was onboarded by TuxCare from upstream 2.11.1, which already contained this fix. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability relates to polymorphic deserialization of the class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (commit 191a4cdf87) adds this class to the blocklist in SubTypeValidator.java and was included in the upstream jackson-databind 2.11.1 release. The target version was onboarded by TuxCare from upstream 2.11.1, which already contained this fix. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3, allowing deserialization of dangerous log4j-extras classes (JNDIConnectionSource, DriverManagerConnectionSource) when Default Typing is enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta, dated 2019-10-12) added these classes to the deny-list in SubTypeValidator.java and was already present in the upstream jackson-databind 2.11.1 release (June 2020) that TuxCare onboarded. The target repository contains the fix at lines 126-128 of SubTypeValidator.java, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3, allowing deserialization of dangerous log4j-extras classes (JNDIConnectionSource, DriverManagerConnectionSource) when Default Typing is enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta, dated 2019-10-12) added these classes to the deny-list in SubTypeValidator.java and was already present in the upstream jackson-databind 2.11.1 release (June 2020) that TuxCare onboarded. The target repository contains the fix at lines 126-128 of SubTypeValidator.java, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability requires the absence of blocklist entries for net.sf.ehcache JNDI selector classes. The fix (adding these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java) was committed to upstream jackson-databind on 2019-11-01 (commits eb254813cc, fc4214a883) and shipped in the upstream 2.11.1 release that TuxCare onboarded. The target contains the defense code at lines 131-132 of SubTypeValidator.java, which blocks deserialization of GenericJndiSelector and GlassfishSelector, preventing the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability requires the absence of blocklist entries for net.sf.ehcache JNDI selector classes. The fix (adding these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java) was committed to upstream jackson-databind on 2019-11-01 (commits eb254813cc, fc4214a883) and shipped in the upstream 2.11.1 release that TuxCare onboarded. The target contains the defense code at lines 131-132 of SubTypeValidator.java, which blocks deserialization of GenericJndiSelector and GlassfishSelector, preventing the JNDI injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta related classes. The target repository (jackson-databind 2.11.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.11.1 release. The patch adds three dangerous class names (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. All three entries are present at lines 152-154 in the target. The fix was authored by upstream maintainer Tatu Saloranta (commit a424c038ba) and shipped in upstream release 2.11.1, which TuxCare later onboarded. Since the fix came with the upstream release rather than being applied by TuxCare, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta related classes. The target repository (jackson-databind 2.11.1-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.11.1 release. The patch adds three dangerous class names (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. All three entries are present at lines 152-154 in the target. The fix was authored by upstream maintainer Tatu Saloranta (commit a424c038ba) and shipped in upstream release 2.11.1, which TuxCare later onboarded. Since the fix came with the upstream release rather than being applied by TuxCare, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 does not affect jackson-databind 2.11.1. The vulnerability involves polymorphic deserialization of gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by Tatu Saloranta) was already included in the upstream Jackson 2.11.1 release that TuxCare onboarded. Both gadget classes are present in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 157-158), and the validateSubType method actively enforces this protection (line 224), throwing a security exception if deserialization is attempted. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 does not affect jackson-databind 2.11.1. The vulnerability involves polymorphic deserialization of gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by Tatu Saloranta) was already included in the upstream Jackson 2.11.1 release that TuxCare onboarded. Both gadget classes are present in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 157-158), and the validateSubType method actively enforces this protection (line 224), throwing a security exception if deserialization is attempted. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10673. The vulnerability concerns the deserialization gadget com.caucho.config.types.ResourceRef, which can lead to arbitrary code execution when Jackson's polymorphic typing is enabled. The fix (blocklisting this gadget class in SubTypeValidator) was already present in the upstream version 2.11.1 that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor (Tatu Saloranta) included the fix in the 2.11.1 release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10673. The vulnerability concerns the deserialization gadget com.caucho.config.types.ResourceRef, which can lead to arbitrary code execution when Jackson's polymorphic typing is enabled. The fix (blocklisting this gadget class in SubTypeValidator) was already present in the upstream version 2.11.1 that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor (Tatu Saloranta) included the fix in the 2.11.1 release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider through Jackson's polymorphic typing. The fix (blocklist entry) was already present in the upstream jackson-databind 2.11.1 release, committed by upstream maintainer Tatu Saloranta on 2020-03-25 in commit 05d7e0e13f. The blocklist entry at SubTypeValidator.java:164-165 prevents instantiation of this class during deserialization, blocking the attack chain from JSON input to gadget execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider through Jackson's polymorphic typing. The fix (blocklist entry) was already present in the upstream jackson-databind 2.11.1 release, committed by upstream maintainer Tatu Saloranta on 2020-03-25 in commit 05d7e0e13f. The blocklist entry at SubTypeValidator.java:164-165 prevents instantiation of this class during deserialization, blocking the attack chain from JSON input to gadget execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget class to achieve arbitrary code execution. The fix (adding JEditorPane to the SubTypeValidator blocklist) was included in upstream commit 6ba4845798 (2020-03-03) by Tatu Saloranta, which was already part of the upstream 2.11.1 release before TuxCare onboarded it. The blocklist entry at SubTypeValidator.java:145 actively prevents JEditorPane deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget class to achieve arbitrary code execution. The fix (adding JEditorPane to the SubTypeValidator blocklist) was included in upstream commit 6ba4845798 (2020-03-03) by Tatu Saloranta, which was already part of the upstream 2.11.1 release before TuxCare onboarded it. The blocklist entry at SubTypeValidator.java:145 actively prevents JEditorPane deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind 2.x before 2.9.10.4. The target version 2.11.1-tuxcare.4 already includes the upstream fix (commit c14c9f99ed) that adds org.apache.activemq.* classes to the SubTypeValidator blocklist. The vulnerable deserialization pattern is not present because the fix was shipped in the upstream jackson-databind 2.11.1 release, before TuxCare onboarded this version. All nine activemq classes identified in the CVE are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 167-178 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind 2.x before 2.9.10.4. The target version 2.11.1-tuxcare.4 already includes the upstream fix (commit c14c9f99ed) that adds org.apache.activemq.* classes to the SubTypeValidator blocklist. The vulnerable deserialization pattern is not present because the fix was shipped in the upstream jackson-databind 2.11.1 release, before TuxCare onboarded this version. All nine activemq classes identified in the CVE are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 167-178 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2020-11112. The vulnerability involves unsafe deserialization of the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class, which could enable arbitrary code execution. The upstream fix (commit 05d7e0e13f) added this class to the SubTypeValidator blocklist in DEFAULT_NO_DESER_CLASS_NAMES, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.11.1 release before TuxCare onboarded the version. The blocklist entry is present at SubTypeValidator.java:180 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable pattern (missing blocklist entry) is not present in the target because the upstream fix was already included in the release version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is NOT AFFECTED by CVE-2020-11112. The vulnerability involves unsafe deserialization of the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class, which could enable arbitrary code execution. The upstream fix (commit 05d7e0e13f) added this class to the SubTypeValidator blocklist in DEFAULT_NO_DESER_CLASS_NAMES, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.11.1 release before TuxCare onboarded the version. The blocklist entry is present at SubTypeValidator.java:180 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable pattern (missing blocklist entry) is not present in the target because the upstream fix was already included in the release version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves missing blocklist protection against deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in jackson-databind 2.11.1 before TuxCare onboarded it (first TuxCare commit: 2b01a1054f). The vulnerable pattern (missing blocklist entry) does not exist in the target. The fix is enforced in SubTypeValidator.validateSubType() which throws JsonMappingException when blocklisted classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves missing blocklist protection against deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist was already present in jackson-databind 2.11.1 before TuxCare onboarded it (first TuxCare commit: 2b01a1054f). The vulnerable pattern (missing blocklist entry) does not exist in the target. The fix is enforced in SubTypeValidator.validateSubType() which throws JsonMappingException when blocklisted classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability concerns missing blocklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean in SubTypeValidator. The upstream fix (commit 113e89fb08, authored by Tatu Saloranta on 2020-04-06) was already included in the upstream 2.11.1 release that TuxCare onboarded on 2026-09-20. Both blocklist entries are present in SubTypeValidator.java lines 53-54, preventing exploitation of these Spring Framework classes as deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability concerns missing blocklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean in SubTypeValidator. The upstream fix (commit 113e89fb08, authored by Tatu Saloranta on 2020-04-06) was already included in the upstream 2.11.1 release that TuxCare onboarded on 2026-09-20. Both blocklist entries are present in SubTypeValidator.java lines 53-54, preventing exploitation of these Spring Framework classes as deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.11.1-tuxcare.4 is not affected by CVE-2020-11620. The vulnerability allows deserialization of the dangerous gadget class `org.apache.commons.jelly.impl.Embedded` via JSON payloads with polymorphic type information, potentially enabling arbitrary code execution. The upstream fix adds this class to a blocklist in `SubTypeValidator.java` that prevents its instantiation during polymorphic deserialization. This fix, authored by upstream maintainer Tatu Saloranta, was included in the upstream jackson-databind 2.11.1 release that TuxCare onboarded, confirming it was not a TuxCare backport but an upstream fix already present in the base version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target repository jackson-databind version 2.11.1-tuxcare.4 is not affected by CVE-2020-11620. The vulnerability allows deserialization of the dangerous gadget class `org.apache.commons.jelly.impl.Embedded` via JSON payloads with polymorphic type information, potentially enabling arbitrary code execution. The upstream fix adds this class to a blocklist in `SubTypeValidator.java` that prevents its instantiation during polymorphic deserialization. This fix, authored by upstream maintainer Tatu Saloranta, was included in the upstream jackson-databind 2.11.1 release that TuxCare onboarded, confirming it was not a TuxCare backport but an upstream fix already present in the base version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 does not affect jackson-databind 2.11.1. The vulnerability targets versions before 2.9.10.5, and the upstream fix (blocking deserialization of \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\") was already present in the 2.11.1 release that TuxCare onboarded. The dangerous gadget class is blocklisted at line 186 of SubTypeValidator.java, preventing the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 does not affect jackson-databind 2.11.1. The vulnerability targets versions before 2.9.10.5, and the upstream fix (blocking deserialization of \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\") was already present in the 2.11.1 release that TuxCare onboarded. The dangerous gadget class is blocklisted at line 186 of SubTypeValidator.java, preventing the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability concerns deserialization gadgets related to five Oracle JMS classes (oracle.jms.AQjms*ConnectionFactory variants). The upstream fix (commit 5c8642aeae by Tatu Saloranta, April 2020) adds these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.11.1 release before TuxCare onboarded it (onboarding commit 2b01a1054f by amoniatovskiy@cloudlinux.com). The target contains the complete defense mechanism that blocks deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.11.1-tuxcare.4. The vulnerability concerns deserialization gadgets related to five Oracle JMS classes (oracle.jms.AQjms*ConnectionFactory variants). The upstream fix (commit 5c8642aeae by Tatu Saloranta, April 2020) adds these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.11.1 release before TuxCare onboarded it (onboarding commit 2b01a1054f by amoniatovskiy@cloudlinux.com). The target contains the complete defense mechanism that blocks deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves polymorphic deserialization of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class enabling JNDI injection and remote code execution. The upstream fix (commit 840eae2ca8 by Tatu Saloranta, May 1, 2020) was already included in Jackson 2.11.1 when TuxCare onboarded it. The fix adds the dangerous class to the SubTypeValidator blacklist at line 119, preventing its deserialization. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is not present in jackson-databind 2.11.1-tuxcare.4. The vulnerability involves polymorphic deserialization of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class enabling JNDI injection and remote code execution. The upstream fix (commit 840eae2ca8 by Tatu Saloranta, May 1, 2020) was already included in Jackson 2.11.1 when TuxCare onboarded it. The fix adds the dangerous class to the SubTypeValidator blacklist at line 119, preventing its deserialization. This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that enables remote code execution. The target repository is jackson-databind version 2.11.1-tuxcare.4. The fix for this vulnerability (commit f6d9c664f6, adding the gadget class to SubTypeValidator's blocklist) was committed upstream on 2020-06-13 and included in the upstream 2.11.1 release (tagged 2020-06-24). TuxCare onboarded this already-fixed upstream version on 2026-09-20 (commit 2b01a1054f). The vulnerable code pattern was never present in the TuxCare-maintained codebase. Verification confirms the blocklist entry exists at SubTypeValidator.java:198 and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget (org.jsecurity.realm.jndi.JndiRealmFactory) that enables remote code execution. The target repository is jackson-databind version 2.11.1-tuxcare.4. The fix for this vulnerability (commit f6d9c664f6, adding the gadget class to SubTypeValidator's blocklist) was committed upstream on 2020-06-13 and included in the upstream 2.11.1 release (tagged 2020-06-24). TuxCare onboarded this already-fixed upstream version on 2026-09-20 (commit 2b01a1054f). The vulnerable code pattern was never present in the TuxCare-maintained codebase. Verification confirms the blocklist entry exists at SubTypeValidator.java:198 and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:25.262267+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:25.262267+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.11.1-tuxcare.4. The upstream fix by Tatu Saloranta (commit 612f971b78, addressing issue #2589) was already included in the jackson-databind 2.11.1 release that TuxCare onboarded. The fix adds two critical XML parser security features: (1) disallows DOCTYPE declarations via \"disallow-doctype-decl\" and (2) disables external DTD loading via \"load-external-dtd=false\", preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.11.1-tuxcare.4. The upstream fix by Tatu Saloranta (commit 612f971b78, addressing issue #2589) was already included in the jackson-databind 2.11.1 release that TuxCare onboarded. The fix adds two critical XML parser security features: (1) disallows DOCTYPE declarations via \"disallow-doctype-decl\" and (2) disables external DTD loading via \"load-external-dtd=false\", preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:25.262267+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T14:26:00.096253+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T14:26:00.096253+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T14:26:00.096253+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T14:26:00.096253+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:25.262267+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.1-tuxcare.4 is not affected by CVE-2020-8840. The vulnerability allows remote code execution via polymorphic deserialization of org.apache.xbean.propertyeditor.JndiConverter, but this class is blocked by the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java:135. The fix was shipped in upstream jackson-databind 2.11.1 (commit 914e7c9f2c by Tatu Saloranta) before TuxCare onboarded the version. The blocklist is actively enforced during deserialization through validateSubType() called from BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind 2.11.1-tuxcare.4 is not affected by CVE-2020-8840. The vulnerability allows remote code execution via polymorphic deserialization of org.apache.xbean.propertyeditor.JndiConverter, but this class is blocked by the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java:135. The fix was shipped in upstream jackson-databind 2.11.1 (commit 914e7c9f2c by Tatu Saloranta) before TuxCare onboarded the version. The blocklist is actively enforced during deserialization through validateSubType() called from BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability involving org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.11.1 is not affected because the upstream fix (adding HikariConfig to the SubTypeValidator blacklist) was already present in the upstream 2.11.1 release before TuxCare onboarding. The fix commit 9f4e97019fb by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability involving org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.11.1 is not affected because the upstream fix (adding HikariConfig to the SubTypeValidator blacklist) was already present in the upstream 2.11.1 release before TuxCare onboarding. The fix commit 9f4e97019fb by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit 2b01a1054f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.11.1-tuxcare.4 is NOT AFFECTED because the upstream vendor (FasterXML) already included the fix in release 2.11.1. The gadget class is blacklisted in SubTypeValidator.java (lines 140-142), preventing polymorphic deserialization. The fix commit (1e64db6a2f, Feb 29, 2020) by Tatu Saloranta predates TuxCare's onboarding of version 2.11.1 (2b01a1054f, Sep 20, 2026), confirming this is an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.11.1-tuxcare.4 is NOT AFFECTED because the upstream vendor (FasterXML) already included the fix in release 2.11.1. The gadget class is blacklisted in SubTypeValidator.java (lines 140-142), preventing polymorphic deserialization. The fix commit (1e64db6a2f, Feb 29, 2020) by Tatu Saloranta predates TuxCare's onboarding of version 2.11.1 (2b01a1054f, Sep 20, 2026), confirming this is an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.1 is not affected by CVE-2020-9548. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream release 2.11.1 before TuxCare onboarded it. The CVE affects versions BEFORE 2.9.10.4, and 2.11.1 is a later release that includes the fix. The blocklist entry is present at SubTypeValidator.java:142 and is actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "Target version 2.11.1 is not affected by CVE-2020-9548. The vulnerability concerns deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream release 2.11.1 before TuxCare onboarded it. The CVE affects versions BEFORE 2.9.10.4, and 2.11.1 is a later release that includes the fix. The blocklist entry is present at SubTypeValidator.java:142 and is actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:25.262267+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54517 affects jackson-databind >= 2.21.0 where setterless collection/map properties bypass @JsonView filters via a buffering path lacking view checks. The vulnerability was introduced when SetterlessProperty.isMerging() started returning true, routing setterless properties through the unguarded buffer. Version 2.11.1 lacks the isMerging() mechanism entirely\u2014the method does not exist in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54517 affects jackson-databind >= 2.21.0 where setterless collection/map properties bypass @JsonView filters via a buffering path lacking view checks. The vulnerability was introduced when SetterlessProperty.isMerging() started returning true, routing setterless properties through the unguarded buffer. Version 2.11.1 lacks the isMerging() mechanism entirely\u2014the method does not exist in..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:25.262267+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.11.1 is not affected by CVE-2026-59888. This vulnerability specifically affects Java Record deserialization when @JsonIgnore and PropertyNamingStrategy are used together. Java Record support was added to jackson-databind in version 2.12.0 (released August 2020), which is after version 2.11.1 (released June 2020). While the vulnerable code pattern exists in POJOPropertiesCollector._ren...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.1 is not affected by CVE-2026-59888. This vulnerability specifically affects Java Record deserialization when @JsonIgnore and PropertyNamingStrategy are used together. Java Record support was added to jackson-databind in version 2.12.0 (released August 2020), which is after version 2.11.1 (released June 2020). While the vulnerable code pattern exists in POJOPropertiesCollector._ren..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.11.1-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.1-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T09:27:07.556600+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.11.1-tuxcare.5.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}