{
  "@id": "urn:uuid:76e0a71b-18e6-406c-bca5-9aaf247ae547",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 68,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T11:32:20.370514+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.11.2-tuxcare.1, which includes the upstream fixes for both #1680 (JdbcRowSetImpl) and #1737 (FileHandler, UnicastRemoteObject, and Spring/c3p0 types). The fix was introduced by upstream maintainer Tatu Saloranta in commits e8f043d1 and ddfddfba, which are ancestors of the first TuxCare commit (a7a5ae30 \"setup 2.11.2\"). The vulnerable deserialization gadget classes are blacklisted in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES and blocked by the validateSubType method. Since the fix shipped with the upstream 2.11.2 release, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.11.2-tuxcare.1, which includes the upstream fixes for both #1680 (JdbcRowSetImpl) and #1737 (FileHandler, UnicastRemoteObject, and Spring/c3p0 types). The fix was introduced by upstream maintainer Tatu Saloranta in commits e8f043d1 and ddfddfba, which are ancestors of the first TuxCare commit (a7a5ae30 \"setup 2.11.2\"). The vulnerable deserialization gadget classes are blacklisted in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES and blocked by the validateSubType method. Since the fix shipped with the upstream 2.11.2 release, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerability was fixed by upstream vendor FasterXML in versions 2.8.11 and 2.9.0 (December 2017), over 2.5 years before the target version 2.11.2 (August 2020). The fixes include: (1) SubTypeValidator class with comprehensive blacklist of dangerous classes, (2) pattern-based checks blocking Spring classes extending AbstractPointcutAdvisor/AbstractApplicationContext, and (3) C3P0 DataSource blocking. These defenses prevent the polymorphic deserialization of attacker-chosen classes that could lead to RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerability was fixed by upstream vendor FasterXML in versions 2.8.11 and 2.9.0 (December 2017), over 2.5 years before the target version 2.11.2 (August 2020). The fixes include: (1) SubTypeValidator class with comprehensive blacklist of dangerous classes, (2) pattern-based checks blocking Spring classes extending AbstractPointcutAdvisor/AbstractApplicationContext, and (3) C3P0 DataSource blocking. These defenses prevent the polymorphic deserialization of attacker-chosen classes that could lead to RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:29:00.089538+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.11.2. The vulnerability involved unsafe deserialization of attacker-controlled class types (e.g., TemplatesImpl) when default typing was enabled. The fix was introduced upstream in versions 2.7.10, 2.8.9 (April 2017) as checkIllegalTypes(), then refactored into SubTypeValidator (December 2017, issue #1855). Version 2.11.2 (released August 2020) shipped with the fix already present. TuxCare onboarded the upstream 2.11.2 release via setup commit a7a5ae30fc, which already contained SubTypeValidator with the complete blocklist for databind#1599. The vulnerable pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.11.2. The vulnerability involved unsafe deserialization of attacker-controlled class types (e.g., TemplatesImpl) when default typing was enabled. The fix was introduced upstream in versions 2.7.10, 2.8.9 (April 2017) as checkIllegalTypes(), then refactored into SubTypeValidator (December 2017, issue #1855). Version 2.11.2 (released August 2020) shipped with the fix already present. TuxCare onboarded the upstream 2.11.2 release via setup commit a7a5ae30fc, which already contained SubTypeValidator with the complete blocklist for databind#1599. The vulnerable pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 via use of Jackson default typing with an iBatis gadget class (org.apache.ibatis.parsing.XPathParser) allowing data exfiltration. The target repository is jackson-databind version 2.11.2-tuxcare.1, which already contains the upstream vendor fix. The fix (commit 27b4defc by Tatu Saloranta) adds XPathParser to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, blocking polymorphic deserialization of this dangerous class. This fix was included in the upstream jackson-databind 2.11.2 release before TuxCare onboarded the version, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 via use of Jackson default typing with an iBatis gadget class (org.apache.ibatis.parsing.XPathParser) allowing data exfiltration. The target repository is jackson-databind version 2.11.2-tuxcare.1, which already contains the upstream vendor fix. The fix (commit 27b4defc by Tatu Saloranta) adds XPathParser to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, blocking polymorphic deserialization of this dangerous class. This fix was included in the upstream jackson-databind 2.11.2 release before TuxCare onboarded the version, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:10.514084+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.2 is not affected by CVE-2018-12022. The vulnerability allows attackers to achieve remote code execution via polymorphic deserialization of Jodd-db and Oracle JDBC classes that initiate LDAP connections when Default Typing is enabled. The upstream fix adds these three dangerous class names to SubTypeValidator's blacklist: jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. This fix was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded (commit a7a5ae30fc), installed by upstream commit 28badf7ef6 authored by tatu.saloranta@iki.fi. The blacklist validation is mandatory during bean deserializer creation and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "Target jackson-databind 2.11.2 is not affected by CVE-2018-12022. The vulnerability allows attackers to achieve remote code execution via polymorphic deserialization of Jodd-db and Oracle JDBC classes that initiate LDAP connections when Default Typing is enabled. The upstream fix adds these three dangerous class names to SubTypeValidator's blacklist: jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. This fix was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded (commit a7a5ae30fc), installed by upstream commit 28badf7ef6 authored by tatu.saloranta@iki.fi. The blacklist validation is mandatory during bean deserializer creation and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:21:06.039557+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing attackers to execute malicious payloads via Oracle JDBC classes. The target repository (jackson-databind 2.11.2-tuxcare.2) is NOT affected because the upstream fix was already present in the 2.11.2 release. The fix adds oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the deserialization blocklist in SubTypeValidator.java (lines 70-72), preventing these classes from being instantiated during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing attackers to execute malicious payloads via Oracle JDBC classes. The target repository (jackson-databind 2.11.2-tuxcare.2) is NOT affected because the upstream fix was already present in the 2.11.2 release. The fix adds oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the deserialization blocklist in SubTypeValidator.java (lines 70-72), preventing these classes from being instantiated during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:53:55.157124+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.11.2-tuxcare.2. The fix blocking org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream 2.11.2 release that TuxCare onboarded. The blocklist entry exists in SubTypeValidator.java:75, and the validation mechanism actively rejects attempts to deserialize this gadget class with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.11.2-tuxcare.2. The fix blocking org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream 2.11.2 release that TuxCare onboarded. The blocklist entry exists in SubTypeValidator.java:75, and the validation mechanism actively rejects attempts to deserialize this gadget class with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.2-tuxcare.2) is not affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of dangerous classes from blaze-ds-opt/blaze-ds-core (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes). The upstream fix by Tatu Saloranta (commit 87d29af) added these four classes to the deserialization blocklist and was already present in the upstream 2.11.2 release that TuxCare onboarded. All four blocked classes are present in SubTypeValidator.java:75-78, preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "The target repository (jackson-databind 2.11.2-tuxcare.2) is not affected by CVE-2018-14719. The vulnerability involves polymorphic deserialization of dangerous classes from blaze-ds-opt/blaze-ds-core (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes). The upstream fix by Tatu Saloranta (commit 87d29af) added these four classes to the deserialization blocklist and was already present in the upstream 2.11.2 release that TuxCare onboarded. All four blocked classes are present in SubTypeValidator.java:75-78, preventing the exploitation path described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:08:55.717276+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2018-14720. The upstream fix blocking the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization was already present in the upstream 2.11.2 release. The fix (commit 87d29af25e by upstream FasterXML maintainer tatu.saloranta@iki.fi) was included when TuxCare onboarded version 2.11.2, predating all TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "Target repository jackson-databind 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2018-14720. The upstream fix blocking the four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization was already present in the upstream 2.11.2 release. The fix (commit 87d29af25e by upstream FasterXML maintainer tatu.saloranta@iki.fi) was included when TuxCare onboarded version 2.11.2, predating all TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:38:50.686696+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 (SSRF via axis2-jaxws polymorphic deserialization) is NOT present in jackson-databind 2.11.2-tuxcare.2. The upstream vendor fix that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in upstream release 2.11.2, which TuxCare later onboarded. The blocklist entry exists at SubTypeValidator.java:78 in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 (SSRF via axis2-jaxws polymorphic deserialization) is NOT present in jackson-databind 2.11.2-tuxcare.2. The upstream vendor fix that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in upstream release 2.11.2, which TuxCare later onboarded. The blocklist entry exists at SubTypeValidator.java:78 in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:11.363618+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.11.2-tuxcare.1. The vulnerability involves polymorphic deserialization of org.apache.axis2.transport.jms.JMSOutTransportInfo, which was fixed by upstream in commit 72cd4025a2 (Nov 2018) by adding this class to SubTypeValidator's blocklist. The fix was already present in the upstream release before TuxCare onboarded the repository, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.11.2-tuxcare.1. The vulnerability involves polymorphic deserialization of org.apache.axis2.transport.jms.JMSOutTransportInfo, which was fixed by upstream in commit 72cd4025a2 (Nov 2018) by adding this class to SubTypeValidator's blocklist. The fix was already present in the upstream release before TuxCare onboarded the repository, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:56:42.390113+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of dangerous OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The upstream fix (commit 72cd4025a2, dated 2018-11-19) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.11.2 release (2020-08-02) before TuxCare onboarded the version, making the target inherently not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of dangerous OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The upstream fix (commit 72cd4025a2, dated 2018-11-19) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.11.2 release (2020-08-02) before TuxCare onboarded the version, making the target inherently not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:25:11.271555+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2-tuxcare.2 is not affected by CVE-2018-19362. The vulnerability affects jackson-databind versions before 2.9.8, allowing arbitrary code execution through polymorphic deserialization of jboss-common-core classes. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) added org.jboss.util.propertyeditor.DocumentEditor and other gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.11.2 release that TuxCare onboarded, as confirmed by the setup commit a7a5ae30fc containing the complete blocklist. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target jackson-databind 2.11.2-tuxcare.2 is not affected by CVE-2018-19362. The vulnerability affects jackson-databind versions before 2.9.8, allowing arbitrary code execution through polymorphic deserialization of jboss-common-core classes. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) added org.jboss.util.propertyeditor.DocumentEditor and other gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.11.2 release that TuxCare onboarded, as confirmed by the setup commit a7a5ae30fc containing the complete blocklist. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.11.2. The upstream vendor (FasterXML) fixed this vulnerability in January 2018 by adding two gadget classes to the deserialization blacklist. This fix was already present in the upstream 2.11.2 release that TuxCare onboarded, making the target immune to this specific remote code execution vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.11.2. The upstream vendor (FasterXML) fixed this vulnerability in January 2018 by adding two gadget classes to the deserialization blacklist. This fix was already present in the upstream 2.11.2 release that TuxCare onboarded, making the target immune to this specific remote code execution vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:50:27.486705+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerability allowed unauthenticated remote code execution via maliciously crafted JSON exploiting c3p0 library classes during polymorphic deserialization. The fix (commit 6799f8f10c, February 2018) added validation in SubTypeValidator.java that blocks deserialization of classes matching pattern \"com.mchange.v2.c3p0.*DataSource\". This defense is present and active in the target at SubTypeValidator.java:246-255. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.5 (March 2018). Version 2.11.2 was released August 2020, more than 2 years after the fix. The fix predates TuxCare's onboarding commit (a7a5ae30fc \"setup 2.11.2\"), confirming it was already in the upstream release. Target is not affected because the vulnerable pattern (missing c3p0 validation) is not present\u2014the upstream fix was already included in version 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerability allowed unauthenticated remote code execution via maliciously crafted JSON exploiting c3p0 library classes during polymorphic deserialization. The fix (commit 6799f8f10c, February 2018) added validation in SubTypeValidator.java that blocks deserialization of classes matching pattern \"com.mchange.v2.c3p0.*DataSource\". This defense is present and active in the target at SubTypeValidator.java:246-255. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.5 (March 2018). Version 2.11.2 was released August 2020, more than 2 years after the fix. The fix predates TuxCare's onboarding commit (a7a5ae30fc \"setup 2.11.2\"), confirming it was already in the upstream release. Target is not affected because the vulnerable pattern (missing c3p0 validation) is not present\u2014the upstream fix was already included in version 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.11.2 was released after 2.9.9 and already contains the upstream fix that blocks com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) and shipped in the upstream 2.11.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.11.2 was released after 2.9.9 and already contains the upstream fix that blocks com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) and shipped in the upstream 2.11.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:37:49.183323+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.11.2-tuxcare.2) contains the fix for CVE-2019-12384. The blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource is present at line 91 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.11.2 release before TuxCare's onboarding commit (a7...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.11.2-tuxcare.2) contains the fix for CVE-2019-12384. The blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource is present at line 91 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.11.2 release before TuxCare's onboarding commit (a7..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:20:00.097137+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2019-12814. The upstream vendor (FasterXML) fixed this vulnerability in commit 5f7c69bba0 by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.11.2 when TuxCare onboarded it. The target contain...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 Target jackson-databind 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2019-12814. The upstream vendor (FasterXML) fixed this vulnerability in commit 5f7c69bba0 by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.11.2 when TuxCare onboarded it. The target contain..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:12:40.044104+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.2-tuxcare.1 is NOT affected by CVE-2019-14379. The fix was already present in the upstream 2.11.2 release that TuxCare onboarded. The dangerous class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` is blocked by the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 98), preventing the RCE attack vector. Fix commit ad418eeb97 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (a7a5ae30fc \"setup 2.11.2\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "Target jackson-databind 2.11.2-tuxcare.1 is NOT affected by CVE-2019-14379. The fix was already present in the upstream 2.11.2 release that TuxCare onboarded. The dangerous class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` is blocked by the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 98), preventing the RCE attack vector. Fix commit ad418eeb97 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (a7a5ae30fc \"setup 2.11.2\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:59.098532+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.11.2-tuxcare.1. The vulnerability targets the logback class ch.qos.logback.core.db.JNDIConnectionSource for polymorphic deserialization exploitation. The upstream fix (commit ad418eeb97) blacklists this class in SubTypeValidator.java and was shipped in the upstream 2.11.2 release that TuxCare onboarded. The blacklist entry exists at line 102 and is actively enforced during bean deserialization, throwing JsonMappingException to prevent instantiation of the dangerous class. This is an upstream fix that predates TuxCare's involvement with this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.11.2-tuxcare.1. The vulnerability targets the logback class ch.qos.logback.core.db.JNDIConnectionSource for polymorphic deserialization exploitation. The upstream fix (commit ad418eeb97) blacklists this class in SubTypeValidator.java and was shipped in the upstream 2.11.2 release that TuxCare onboarded. The blacklist entry exists at line 102 and is actively enforced during bean deserialization, throwing JsonMappingException to prevent instantiation of the dangerous class. This is an upstream fix that predates TuxCare's involvement with this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind before version 2.9.10 and relates to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target repository is jackson-databind version 2.11.2-tuxcare.2, which already contains the upstream fix. The fix (commits d4983c740f and 73c1c2cc76) adds HikariConfig and HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. These fixes were authored by the upstream maintainer (tatu.saloranta@iki.fi) and were already present in the upstream 2.11.2 release that TuxCare onboarded. Therefore, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind before version 2.9.10 and relates to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target repository is jackson-databind version 2.11.2-tuxcare.2, which already contains the upstream fix. The fix (commits d4983c740f and 73c1c2cc76) adds HikariConfig and HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. These fixes were authored by the upstream maintainer (tatu.saloranta@iki.fi) and were already present in the upstream 2.11.2 release that TuxCare onboarded. Therefore, the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:03.771822+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration 1 and 2 JNDI classes to achieve arbitrary code execution. The target repository is jackson-databind version 2.11.2, which already contains the upstream fix. The fix (commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af) was authored by Tatu Saloranta and shipped in the upstream 2.11.2 release before TuxCare onboarded this version. The blocklist in SubTypeValidator.java includes both org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration 1 and 2 JNDI classes to achieve arbitrary code execution. The target repository is jackson-databind version 2.11.2, which already contains the upstream fix. The fix (commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af) was authored by Tatu Saloranta and shipped in the upstream 2.11.2 release before TuxCare onboarded this version. The blocklist in SubTypeValidator.java includes both org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 (xalan JNDI gadget polymorphic deserialization) is NOT present in jackson-databind 2.11.2-tuxcare.2. The fix adding org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist was authored by upstream maintainer Tatu Saloranta (commit 998efd7, September 2019) and shipped in the upstream 2.11.2 release (August 2020) that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:117, blocking the attack vector before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 (xalan JNDI gadget polymorphic deserialization) is NOT present in jackson-databind 2.11.2-tuxcare.2. The fix adding org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist was authored by upstream maintainer Tatu Saloranta (commit 998efd7, September 2019) and shipped in the upstream 2.11.2 release (August 2020) that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:117, blocking the attack vector before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:24.314148+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.2-tuxcare.2 is NOT vulnerable to CVE-2019-16335. The upstream fix (commit 73c1c2cc76 by Tatu Saloranta, 2019-09-12) that adds HikariDataSource to the SubTypeValidator blocklist was already present in the upstream 2.11.2 release before TuxCare onboarding. The blocklist entry at SubTypeValidator.java:107 prevents polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, blocking the attack path from malicious JSON input to RCE/unauthorized access. The defense is actively enforced through BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "Target jackson-databind 2.11.2-tuxcare.2 is NOT vulnerable to CVE-2019-16335. The upstream fix (commit 73c1c2cc76 by Tatu Saloranta, 2019-09-12) that adds HikariDataSource to the SubTypeValidator blocklist was already present in the upstream 2.11.2 release before TuxCare onboarding. The blocklist entry at SubTypeValidator.java:107 prevents polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, blocking the attack path from malicious JSON input to RCE/unauthorized access. The defense is actively enforced through BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind when Default Typing is enabled and commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) can be deserialized to achieve RCE via JNDI/RMI. The target (jackson-databind 2.11.2-tuxcare.2) already contains the upstream vendor fix: these dangerous classes are blocklisted in SubTypeValidator.java (lines 121-124). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9593e16cf5 and was already present in the jackson-databind 2.11.2 release that TuxCare onboarded. SubTypeValidator.instance().validateSubType() is called during deserialization (BeanDeserializerFactory line 141) and enforces the blocklist, preventing instantiation of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind when Default Typing is enabled and commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) can be deserialized to achieve RCE via JNDI/RMI. The target (jackson-databind 2.11.2-tuxcare.2) already contains the upstream vendor fix: these dangerous classes are blocklisted in SubTypeValidator.java (lines 121-124). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9593e16cf5 and was already present in the jackson-databind 2.11.2 release that TuxCare onboarded. SubTypeValidator.instance().validateSubType() is called during deserialization (BeanDeserializerFactory line 141) and enforces the blocklist, preventing instantiation of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:16:29.149062+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability affects the deserialization of com.p6spy.engine.spy.P6DataSource when polymorphic Default Typing is enabled. The target contains the upstream fix that blocks P6DataSource deserialization in SubTypeValidator.java (line 124). This fix was introduced by upstream commit 9593e16cf5a3d289a9c584f7123639655de9ddac and was already present in the upstream jackson-databind 2.11.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability affects the deserialization of com.p6spy.engine.spy.P6DataSource when polymorphic Default Typing is enabled. The target contains the upstream fix that blocks P6DataSource deserialization in SubTypeValidator.java (line 124). This fix was introduced by upstream commit 9593e16cf5a3d289a9c584f7123639655de9ddac and was already present in the upstream jackson-databind 2.11.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2-tuxcare.2 is not affected by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the gadget class \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\". The fix (adding this class to SubTypeValidator's blocklist at line 99) was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The fix commit (191a4cdf87) by Tatu Saloranta is an ancestor of the first TuxCare commit (a7a5ae30fc), confirming it shipped with the upstream release before TuxCare's maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target jackson-databind 2.11.2-tuxcare.2 is not affected by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the gadget class \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\". The fix (adding this class to SubTypeValidator's blocklist at line 99) was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The fix commit (191a4cdf87) by Tatu Saloranta is an ancestor of the first TuxCare commit (a7a5ae30fc), confirming it shipped with the upstream release before TuxCare's maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:19.112170+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2-tuxcare.2 is NOT affected by CVE-2019-17531. The fix (adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the SubTypeValidator denylist) was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The fixing commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream author tatu.saloranta@iki.fi (dated 2019-10-12) is an ancestor of the first TuxCare commit, confirming it shipped in the upstream release. The vulnerable pattern (missing denylist entries allowing polymorphic deserialization of dangerous log4j-extras classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "The target jackson-databind 2.11.2-tuxcare.2 is NOT affected by CVE-2019-17531. The fix (adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the SubTypeValidator denylist) was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The fixing commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream author tatu.saloranta@iki.fi (dated 2019-10-12) is an ancestor of the first TuxCare commit, confirming it shipped in the upstream release. The vulnerable pattern (missing denylist entries allowing polymorphic deserialization of dangerous log4j-extras classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.11.2-tuxcare.2 is not affected by CVE-2019-20330. The vulnerability requires the absence of ehcache class blocklist entries (GenericJndiSelector and GlassfishSelector), but these entries are present in SubTypeValidator.java at lines 131-132. The fix was shipped in the upstream release 2.11.2, which TuxCare onboarded, and was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare/CloudLinux. The blocklist is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target jackson-databind version 2.11.2-tuxcare.2 is not affected by CVE-2019-20330. The vulnerability requires the absence of ehcache class blocklist entries (GenericJndiSelector and GlassfishSelector), but these entries are present in SubTypeValidator.java at lines 131-132. The fix was shipped in the upstream release 2.11.2, which TuxCare onboarded, and was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare/CloudLinux. The blocklist is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 concerns unsafe deserialization of ignite-jta gadget classes in jackson-databind. The target repository (jackson-databind 2.11.2-tuxcare.2) is NOT affected because the upstream fix (commit a424c038ba) was already present in the upstream release 2.11.2 before TuxCare onboarded it. The fix adds three dangerous classes to the SubTypeValidator blocklist (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider), preventing their deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 concerns unsafe deserialization of ignite-jta gadget classes in jackson-databind. The target repository (jackson-databind 2.11.2-tuxcare.2) is NOT affected because the upstream fix (commit a424c038ba) was already present in the upstream release 2.11.2 before TuxCare onboarded it. The fix adds three dangerous classes to the SubTypeValidator blocklist (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider), preventing their deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 does not affect jackson-databind 2.11.2-tuxcare.2. The vulnerability involves deserialization gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The upstream vendor (FasterXML) fixed this vulnerability by adding the gadget class to SubTypeValidator's blocklist in commit 592872f4 (March 2020), which shipped in upstream jackson-databind 2.11.2 (August 2020). TuxCare later onboarded version 2.11.2 which already contained this fix. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 does not affect jackson-databind 2.11.2-tuxcare.2. The vulnerability involves deserialization gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The upstream vendor (FasterXML) fixed this vulnerability by adding the gadget class to SubTypeValidator's blocklist in commit 592872f4 (March 2020), which shipped in upstream jackson-databind 2.11.2 (August 2020). TuxCare later onboarded version 2.11.2 which already contained this fix. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:28:12.870489+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability concerns deserialization of the com.caucho.config.types.ResourceRef gadget class. The upstream fix (commit 1645efbd39 by Tatu Saloranta) added ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in upstream version 2.11.2 when TuxCare onboarded it (first TuxCare commit a7a5ae30fc \"setup 2.11.2\"). The blacklist is actively enforced in the validateSubType() method at line 227, which checks if incoming class names match the blacklist and rejects them.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability concerns deserialization of the com.caucho.config.types.ResourceRef gadget class. The upstream fix (commit 1645efbd39 by Tatu Saloranta) added ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in upstream version 2.11.2 when TuxCare onboarded it (first TuxCare commit a7a5ae30fc \"setup 2.11.2\"). The blacklist is actively enforced in the validateSubType() method at line 227, which checks if incoming class names match the blacklist and rejects them.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.2-tuxcare.2 is not affected by CVE-2020-10968. The vulnerability required deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider, which is blocked by SubTypeValidator at line 165. This fix was added in upstream commit 05d7e0e13f by Jackson maintainer Tatu Saloranta and was already present in Jackson 2.11.2 when TuxCare onboarded it via commit a7a5ae30fc (\"setup 2.11.2\"). The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "Target jackson-databind 2.11.2-tuxcare.2 is not affected by CVE-2020-10968. The vulnerability required deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider, which is blocked by SubTypeValidator at line 165. This fix was added in upstream commit 05d7e0e13f by Jackson maintainer Tatu Saloranta and was already present in Jackson 2.11.2 when TuxCare onboarded it via commit a7a5ae30fc (\"setup 2.11.2\"). The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2 is NOT vulnerable to CVE-2020-10969. The upstream fix (blocking deserialization of javax.swing.JEditorPane) was included in jackson-databind 2.9.10.4 (March 2020) and is present in all subsequent releases including 2.11.2. The fix commit (4d038c9de0aa80a5dae27f552a975cb39cc42b60) by upstream maintainer Tatu Saloranta added \"javax.swing.JEditorPane\" to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java, which prevents exploitation of this deserialization gadget. This upstream fix was already in the 2.11.2 release that TuxCare onboarded in October 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target jackson-databind 2.11.2 is NOT vulnerable to CVE-2020-10969. The upstream fix (blocking deserialization of javax.swing.JEditorPane) was included in jackson-databind 2.9.10.4 (March 2020) and is present in all subsequent releases including 2.11.2. The fix commit (4d038c9de0aa80a5dae27f552a975cb39cc42b60) by upstream maintainer Tatu Saloranta added \"javax.swing.JEditorPane\" to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java, which prevents exploitation of this deserialization gadget. This upstream fix was already in the 2.11.2 release that TuxCare onboarded in October 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerability involves Jackson deserialization gadgets using org.apache.activemq.* classes. The fix (blacklisting nine ActiveMQ classes in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commit c14c9f99ed030dbd1440129585f03440c8758a99, which was already part of the upstream 2.11.2 release when TuxCare onboarded it. The target repository contains the complete fix with all nine ActiveMQ classes properly blacklisted and enforced via validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerability involves Jackson deserialization gadgets using org.apache.activemq.* classes. The fix (blacklisting nine ActiveMQ classes in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commit c14c9f99ed030dbd1440129585f03440c8758a99, which was already part of the upstream 2.11.2 release when TuxCare onboarded it. The target repository contains the complete fix with all nine ActiveMQ classes properly blacklisted and enforced via validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2020-11112. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) that adds the blocklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the jackson-databind 2.11.2 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked by SubTypeValidator at line 180, and this defense is actively enforced during bean deserialization (BeanDeserializerFactory line 141). The fix predates all TuxCare commits in this repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target jackson-databind 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2020-11112. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) that adds the blocklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider was already present in the jackson-databind 2.11.2 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked by SubTypeValidator at line 180, and this defense is actively enforced during bean deserialization (BeanDeserializerFactory line 141). The fix predates all TuxCare commits in this repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository (jackson-databind 2.11.2-tuxcare.2) is NOT AFFECTED because the upstream fix was already present in version 2.11.2 when TuxCare onboarded it. The dangerous class is blocked in SubTypeValidator.java line 84, added by upstream maintainer Tatu Saloranta in commit e2ba12d5d60 (Fix #2670), which was released in upstream version 2.9.10.4 (March 2020) and inherited by all subsequent versions including 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository (jackson-databind 2.11.2-tuxcare.2) is NOT AFFECTED because the upstream fix was already present in version 2.11.2 when TuxCare onboarded it. The dangerous class is blocked in SubTypeValidator.java line 84, added by upstream maintainer Tatu Saloranta in commit e2ba12d5d60 (Fix #2670), which was released in upstream version 2.9.10.4 (March 2020) and inherited by all subsequent versions including 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2-tuxcare.2 is NOT affected by CVE-2020-11619. The vulnerability involves deserialization gadgets using org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded, and is confirmed at SubTypeValidator.java lines 52-54. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target jackson-databind 2.11.2-tuxcare.2 is NOT affected by CVE-2020-11619. The vulnerability involves deserialization gadgets using org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.11.2 release that TuxCare onboarded, and is confirmed at SubTypeValidator.java lines 52-54. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.11.2. The vulnerability relates to unsafe deserialization of org.apache.commons.jelly.impl.Embedded, which can be exploited as a gadget chain. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already included in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit, confirming it shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.11.2. The vulnerability relates to unsafe deserialization of org.apache.commons.jelly.impl.Embedded, which can be exploited as a gadget chain. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already included in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit, confirming it shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability concerns deserialization gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit d1c67a0396e by Tatu Saloranta, dated 2020-04-24) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The CVE states the vulnerability affects versions before 2.9.10.5; version 2.11.2 is well after that threshold. The target repository contains the fix at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability concerns deserialization gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit d1c67a0396e by Tatu Saloranta, dated 2020-04-24) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The CVE states the vulnerability affects versions before 2.9.10.5; version 2.11.2 is well after that threshold. The target repository contains the fix at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.11.2-tuxcare.2. The upstream fix (commit 5c8642aeae) that adds oracle.jms.AQjms* classes to the deserialization blocklist was already included in the upstream 2.11.2 release (August 2020) before TuxCare onboarded this version. All five vulnerable class names are present in SubTypeValidator.java lines 191-195, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.11.2-tuxcare.2. The upstream fix (commit 5c8642aeae) that adds oracle.jms.AQjms* classes to the deserialization blocklist was already included in the upstream 2.11.2 release (August 2020) before TuxCare onboarded this version. All five vulnerable class names are present in SubTypeValidator.java lines 191-195, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target version 2.11.2 already contains the upstream fix that blocks this class from deserialization. The fix was introduced in upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta and was already present in the 2.11.2 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target version 2.11.2 already contains the upstream fix that blocks this class from deserialization. The fix was introduced in upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta and was already present in the 2.11.2 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability involves deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory which enables JNDI injection attacks. The upstream fix (commit f6d9c664f6) added this class to the SubTypeValidator denylist, preventing its deserialization. This fix was already present in the jackson-databind 2.11.2 upstream release that TuxCare onboarded, as confirmed by the fix commit predating the first TuxCare commit (a7a5ae30fc \"setup 2.11.2\"). The target is therefore not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.11.2-tuxcare.2. The vulnerability involves deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory which enables JNDI injection attacks. The upstream fix (commit f6d9c664f6) added this class to the SubTypeValidator denylist, preventing its deserialization. This fix was already present in the jackson-databind 2.11.2 upstream release that TuxCare onboarded, as confirmed by the fix commit predating the first TuxCare commit (a7a5ae30fc \"setup 2.11.2\"). The target is therefore not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:31:59.056168+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "action_statement": "Vulnerability CVE-2020-24616 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:16:30.596459+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerable gadget class 'com.pastdev.httpcomponents.configuration.JndiConfiguration' is blocked from deserialization by the SubTypeValidator blocklist at SubTypeValidator.java:201. This fix was included in the upstream jackson-databind 2.11.2 release (commit 6cc9f1a1af by upstream maintainer Tatu Saloranta, tagged jackson-databind-2.11.2), which predates TuxCare's onboarding of this version. The target shipped with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.11.2-tuxcare.2. The vulnerable gadget class 'com.pastdev.httpcomponents.configuration.JndiConfiguration' is blocked from deserialization by the SubTypeValidator blocklist at SubTypeValidator.java:201. This fix was included in the upstream jackson-databind 2.11.2 release (commit 6cc9f1a1af by upstream maintainer Tatu Saloranta, tagged jackson-databind-2.11.2), which predates TuxCare's onboarding of this version. The target shipped with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2020-25649. The upstream fix (commit 612f971b78c60202e9cd75a299050c8f2d724a59, \"Fix #2589\" by Tatu Saloranta) was included in jackson-databind 2.11.0 and is present in the target. The fix adds two XML parser security features to DOMDeserializer: disallow-doctype-decl=true and load-external-dtd=false, which prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading. This is an upstream fix that shipped in the 2.11.0 release before TuxCare onboarded 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "Target version 2.11.2-tuxcare.2 is NOT AFFECTED by CVE-2020-25649. The upstream fix (commit 612f971b78c60202e9cd75a299050c8f2d724a59, \"Fix #2589\" by Tatu Saloranta) was included in jackson-databind 2.11.0 and is present in the target. The fix adds two XML parser security features to DOMDeserializer: disallow-doctype-decl=true and load-external-dtd=false, which prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading. This is an upstream fix that shipped in the 2.11.0 release before TuxCare onboarded 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:31:59.056168+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T11:32:20.370514+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:31:44.424399+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "action_statement": "Vulnerability CVE-2020-36184 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:31:59.056168+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:34:00.129295+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:03.643431+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.2-tuxcare.2 is NOT vulnerable to CVE-2020-8840. The fix that blocks deserialization of org.apache.xbean.propertyeditor.JndiConverter is present in the codebase at SubTypeValidator.java:135. This fix was authored by the upstream maintainer (Tatu Saloranta) in commit 914e7c9f2cb on 2020-02-09 and was included in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The vulnerable pattern (allowing JndiConverter deserialization) is not present in HEAD due to this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind 2.11.2-tuxcare.2 is NOT vulnerable to CVE-2020-8840. The fix that blocks deserialization of org.apache.xbean.propertyeditor.JndiConverter is present in the codebase at SubTypeValidator.java:135. This fix was authored by the upstream maintainer (Tatu Saloranta) in commit 914e7c9f2cb on 2020-02-09 and was included in the upstream jackson-databind 2.11.2 release that TuxCare onboarded. The vulnerable pattern (allowing JndiConverter deserialization) is not present in HEAD due to this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.11.2-tuxcare.2 is NOT vulnerable because the fix was already present in the upstream 2.11.2 release. The upstream fix (commit 1e64db6a by Tatu Saloranta, Feb 29, 2020) added org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deny-list in SubTypeValidator.java, blocking deserialization of this gadget class. This fix was shipped in the upstream release before TuxCare onboarded version 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.11.2-tuxcare.2 is NOT vulnerable because the fix was already present in the upstream 2.11.2 release. The upstream fix (commit 1e64db6a by Tatu Saloranta, Feb 29, 2020) added org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deny-list in SubTypeValidator.java, blocking deserialization of this gadget class. This fix was shipped in the upstream release before TuxCare onboarded version 2.11.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:41:47.392844+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository is jackson-databind 2.11.2-tuxcare.2, which already contains the upstream fix (commit 1e64db6a2f) that adds the gadget class to the deserialization blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta and shipped in the upstream jackson-databind 2.11.2 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target repository is jackson-databind 2.11.2-tuxcare.2, which already contains the upstream fix (commit 1e64db6a2f) that adds the gadget class to the deserialization blocklist in SubTypeValidator.java. This fix was authored by Tatu Saloranta and shipped in the upstream jackson-databind 2.11.2 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 concerns jackson-databind's deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target (jackson-databind 2.11.2-tuxcare.2) is not affected because the fix was already present in the upstream release 2.11.2 that TuxCare onboarded. The SubTypeValidator.java blocklist contains the entry for br.com.anteros.dbcp.AnterosDBCPConfig (line 142), preventing deserialization of this gadget class. The fix commit (1e64db6a2f) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (a7a5ae30fc \"setup 2.11.2\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 concerns jackson-databind's deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target (jackson-databind 2.11.2-tuxcare.2) is not affected because the fix was already present in the upstream release 2.11.2 that TuxCare onboarded. The SubTypeValidator.java blocklist contains the entry for br.com.anteros.dbcp.AnterosDBCPConfig (line 142), preventing deserialization of this gadget class. The fix commit (1e64db6a2f) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (a7a5ae30fc \"setup 2.11.2\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:34:00.129295+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:31:59.056168+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:31:58.259136+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54517 affects jackson-databind versions 2.21.0+/3.0.0+ where setterless properties bypass @JsonView filtering in property-based creator deserialization. The target version 2.11.2-tuxcare.2 is NOT AFFECTED because it lacks the architectural changes that introduced the vulnerability. The CVE describes a vulnerability introduced \"when SetterlessProperty.isMerging() return true routed sett...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54517 affects jackson-databind versions 2.21.0+/3.0.0+ where setterless properties bypass @JsonView filtering in property-based creator deserialization. The target version 2.11.2-tuxcare.2 is NOT AFFECTED because it lacks the architectural changes that introduced the vulnerability. The CVE describes a vulnerability introduced \"when SetterlessProperty.isMerging() return true routed sett..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:03:09.374599+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.11.2 is not affected by CVE-2026-54518. The vulnerability requires unwrapped creator parameters (@JsonUnwrapped on @JsonCreator parameters), a feature that does not exist in version 2.11.2. The target explicitly throws an exception (\"Cannot define Creator parameter/property as `@JsonUnwrapped`: combination not yet supported\") when this combination is attempted. The vulnerable method `...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.2 is not affected by CVE-2026-54518. The vulnerability requires unwrapped creator parameters (@JsonUnwrapped on @JsonCreator parameters), a feature that does not exist in version 2.11.2. The target explicitly throws an exception (\"Cannot define Creator parameter/property as `@JsonUnwrapped`: combination not yet supported\") when this combination is attempted. The vulnerable method `..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:42:00.098539+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.11.2 is not affected by CVE-2026-59888. This vulnerability is specific to Java Records (introduced in Java 14+), but version 2.11.2 targets Java 7 and contains no Record support code. The vulnerable code pattern (missing propagation of @JsonIgnore status to renamed properties in POJOPropertiesCollector._renameUsing()) exists in the codebase, but the attack chain is broken because: (1)...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.2 is not affected by CVE-2026-59888. This vulnerability is specific to Java Records (introduced in Java 14+), but version 2.11.2 targets Java 7 and contains no Record support code. The vulnerable code pattern (missing propagation of @JsonIgnore status to renamed properties in POJOPropertiesCollector._renameUsing()) exists in the codebase, but the attack chain is broken because: (1)..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:56:00.148907+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:56:00.148907+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:55:14.986935+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:56:00.148907+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:56:00.148907+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.2-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.11.2-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}