{
  "@id": "urn:uuid:a2034620-89e2-445e-9a7e-77164633b07a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 63,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:54:13.646678+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:09:44.726673+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.12.7 is NOT affected by CVE-2017-15095. The vulnerability was fixed in upstream Jackson versions 2.8.11 and 2.9.4 (December 2017) by adding a blacklist of dangerous classes to SubTypeValidator. The fix commit (2235894210c75f624a3d0cd60bfb0434a20a18bf) was authored by Tatu Saloranta (upstream maintainer) and was already present in the upstream release that TuxCare onboarded. All CVE-2017-15095 dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, Spring and C3P0 types) are blacklisted in SubTypeValidator.java lines 30-245, and the validateSubType() method actively enforces this blacklist on every deserialization path via BeanDeserializerFactory.createBeanDeserializer(). The vulnerable deserialization pattern has been absent from jackson-databind since 2017, well before version 2.12.7 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "Target jackson-databind version 2.12.7 is NOT affected by CVE-2017-15095. The vulnerability was fixed in upstream Jackson versions 2.8.11 and 2.9.4 (December 2017) by adding a blacklist of dangerous classes to SubTypeValidator. The fix commit (2235894210c75f624a3d0cd60bfb0434a20a18bf) was authored by Tatu Saloranta (upstream maintainer) and was already present in the upstream release that TuxCare onboarded. All CVE-2017-15095 dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, Spring and C3P0 types) are blacklisted in SubTypeValidator.java lines 30-245, and the validateSubType() method actively enforces this blacklist on every deserialization path via BeanDeserializerFactory.createBeanDeserializer(). The vulnerable deserialization pattern has been absent from jackson-databind since 2017, well before version 2.12.7 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:44:21.734688+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.12.7-tuxcare.4 contains comprehensive upstream fixes that shipped with jackson-databind 2.12.7, including all blacklist entries and pattern-based validation from the CVE-2017-17485 patches (issues #1737 and #1855). The vulnerable deserialization patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version 2.12.7-tuxcare.4 contains comprehensive upstream fixes that shipped with jackson-databind 2.12.7, including all blacklist entries and pattern-based validation from the CVE-2017-17485 patches (issues #1737 and #1855). The vulnerable deserialization patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:27:51.969855+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.7 is not affected by CVE-2017-7525. The vulnerability pattern (unsafe polymorphic deserialization of dangerous gadget classes) is not present because the upstream fix was already included in version 2.12.7 before TuxCare onboarded it. The fix introduces SubTypeValidator with a comprehensive blacklist that blocks deserialization of known dangerous classes including TemplatesImpl, InvokerTransformer, and dozens of other gadget classes. The validation is called in BeanDeserializerFactory.createBeanDeserializer() at line 140 before any deserializer is created.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target jackson-databind version 2.12.7 is not affected by CVE-2017-7525. The vulnerability pattern (unsafe polymorphic deserialization of dangerous gadget classes) is not present because the upstream fix was already included in version 2.12.7 before TuxCare onboarded it. The fix introduces SubTypeValidator with a comprehensive blacklist that blocks deserialization of known dangerous classes including TemplatesImpl, InvokerTransformer, and dozens of other gadget classes. The validation is called in BeanDeserializerFactory.createBeanDeserializer() at line 140 before any deserializer is created.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:18:44.496921+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5, allowing data exfiltration via the iBatis XPathParser gadget class with default typing enabled. The target version 2.12.7 already contains the upstream fix that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java. This fix was present in the upstream 2.12.7 release (fixed in 2.7.9.4, 2.8.11.2, 2.9.6, and all subsequent versions including 2.12.7), which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5, allowing data exfiltration via the iBatis XPathParser gadget class with default typing enabled. The target version 2.12.7 already contains the upstream fix that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java. This fix was present in the upstream 2.12.7 release (fixed in 2.7.9.4, 2.8.11.2, 2.9.6, and all subsequent versions including 2.12.7), which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:19:24.126381+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2018-12022. The vulnerability involves polymorphic deserialization of jodd.db.connection.DataSourceConnectionProvider, exploitable via LDAP when Default Typing is enabled. The vendor fix blacklists this class in SubTypeValidator.java. This fix is present at line 68, added by upstream commit 28badf7ef6 (author: tatu.saloranta@iki.fi), which was included in jackson-databind 2.12.7 before TuxCare onboarded it (first TuxCare commit: 2db6b01a62). The blacklist is properly enforced through BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "The target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2018-12022. The vulnerability involves polymorphic deserialization of jodd.db.connection.DataSourceConnectionProvider, exploitable via LDAP when Default Typing is enabled. The vendor fix blacklists this class in SubTypeValidator.java. This fix is present at line 68, added by upstream commit 28badf7ef6 (author: tatu.saloranta@iki.fi), which was included in jackson-databind 2.12.7 before TuxCare onboarded it (first TuxCare commit: 2db6b01a62). The blacklist is properly enforced through BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:20:17.888209+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerns polymorphic deserialization of Oracle JDBC classes that can trigger JNDI/LDAP lookups when Default Typing is enabled. The upstream fix (blacklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) was introduced in version 2.7.9.4 (June 2018) by upstream maintainer Tatu Saloranta. The target version 2.12.7 (released 2022) already contains this fix in SubTypeValidator.java lines 70-72. The fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerns polymorphic deserialization of Oracle JDBC classes that can trigger JNDI/LDAP lookups when Default Typing is enabled. The upstream fix (blacklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) was introduced in version 2.7.9.4 (June 2018) by upstream maintainer Tatu Saloranta. The target version 2.12.7 (released 2022) already contains this fix in SubTypeValidator.java lines 70-72. The fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:51:14.737145+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is not present in jackson-databind 2.12.7. The vulnerability concerns polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData and others). The upstream fix commit 87d29af25e by Tatu Saloranta (tatu.saloranta@iki.fi) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist and was already present in the upstream 2.12.7 release before TuxCare onboarding. The target contains the fix in SubTypeValidator.java lines 75-78, and SubTypeValidator.validateSubType() actively enforces the blacklist during polymorphic deserialization, throwing \"Illegal type to deserialize: prevented for security reasons\" when blacklisted classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is not present in jackson-databind 2.12.7. The vulnerability concerns polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData and others). The upstream fix commit 87d29af25e by Tatu Saloranta (tatu.saloranta@iki.fi) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist and was already present in the upstream 2.12.7 release before TuxCare onboarding. The target contains the fix in SubTypeValidator.java lines 75-78, and SubTypeValidator.validateSubType() actively enforces the blacklist during polymorphic deserialization, throwing \"Illegal type to deserialize: prevented for security reasons\" when blacklisted classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:00:30.548174+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability involves polymorphic deserialization of blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) leading to arbitrary code execution. The fix was already present in the upstream jackson-databind 2.12.7 release that TuxCare onboarded. The target contains a blocklist in SubTypeValidator.java (line 76) that prevents deserialization of the dangerous class, throwing JsonMappingException before any malicious payload can execute. Fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream maintainer Tatu Saloranta was included in the upstream 2.12.7 release, predating TuxCare's onboarding commit 2db6b01a62e0c2709f6b965215ed7770aeaf27c9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability involves polymorphic deserialization of blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) leading to arbitrary code execution. The fix was already present in the upstream jackson-databind 2.12.7 release that TuxCare onboarded. The target contains a blocklist in SubTypeValidator.java (line 76) that prevents deserialization of the dangerous class, throwing JsonMappingException before any malicious payload can execute. Fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream maintainer Tatu Saloranta was included in the upstream 2.12.7 release, predating TuxCare's onboarding commit 2db6b01a62e0c2709f6b965215ed7770aeaf27c9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:07:52.803278+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.12.7-tuxcare.4. The upstream fix that adds four dangerous class names (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to the deserialization blacklist was already present in the upstream release 2.12.7 when TuxCare onboarded it. The fix commit 0899726ec34 by Tatu Saloranta (upstream maintainer) added these entries to SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES, and the validator actively blocks their deserialization during polymorphic typing operations via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.12.7-tuxcare.4. The upstream fix that adds four dangerous class names (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to the deserialization blacklist was already present in the upstream release 2.12.7 when TuxCare onboarded it. The fix commit 0899726ec34 by Tatu Saloranta (upstream maintainer) added these entries to SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES, and the validator actively blocks their deserialization during polymorphic typing operations via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:37:48.238689+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerable class \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is blocked from polymorphic deserialization by the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java:78. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 on 2018-08-16, merged into upstream version 2.9.7. Since the target is version 2.12.7 (released much later), the fix was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerable class \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" is blocked from polymorphic deserialization by the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java:78. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 on 2018-08-16, merged into upstream version 2.9.7. Since the target is version 2.12.7 (released much later), the fix was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:48:57.330318+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. Target version 2.12.7-tuxcare.3 contains the upstream fix (commit 72cd4025a2) that was shipped in upstream release 2.12.7. The blocklist entry exists at SubTypeValidator.java:85 and is actively enforced during deserialization via BeanDeserializerFactory. The vulnerable code pattern is not present because the upstream vendor fixed it before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. Target version 2.12.7-tuxcare.3 contains the upstream fix (commit 72cd4025a2) that was shipped in upstream release 2.12.7. The blocklist entry exists at SubTypeValidator.java:85 and is actively enforced during deserialization via BeanDeserializerFactory. The vulnerable code pattern is not present because the upstream vendor fixed it before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:56:06.275906+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.12.7 release that TuxCare onboarded. The vulnerable code pattern (absence of openjpa classes from the deserialization blocklist) does not exist at HEAD. The openjpa classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist and will be rejected during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes in polymorphic deserialization. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.12.7 release that TuxCare onboarded. The vulnerable code pattern (absence of openjpa classes from the deserialization blocklist) does not exist at HEAD. The openjpa classes org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist and will be rejected during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:24:42.202771+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor. The target version 2.12.7-tuxcare.4 is NOT affected because the fix was already included in upstream jackson-databind 2.12.7, which TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present - the DocumentEditor class is properly blocked at line 81 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor. The target version 2.12.7-tuxcare.4 is NOT affected because the fix was already included in upstream jackson-databind 2.12.7, which TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present - the DocumentEditor class is properly blocked at line 81 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.12.7. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the existing blacklist to achieve remote code execution. The fix, which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, was already included in the upstream Jackson 2.12.7 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.12.7. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the existing blacklist to achieve remote code execution. The fix, which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, was already included in the upstream Jackson 2.12.7 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2018-7489. The c3p0 DataSource blocking defense was shipped by the upstream vendor (FasterXML) in jackson-databind 2.12.7 before TuxCare onboarded the project. The fix (commit 6799f8f10c by Tatu Saloranta) is present in SubTypeValidator.java lines 288-298, which blocks deserialization of all classes matching `com.mchange.v2.c3p0.*DataSource`. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2018-7489. The c3p0 DataSource blocking defense was shipped by the upstream vendor (FasterXML) in jackson-databind 2.12.7 before TuxCare onboarded the project. The fix (commit 6799f8f10c by Tatu Saloranta) is present in SubTypeValidator.java lines 288-298, which blocks deserialization of all classes matching `com.mchange.v2.c3p0.*DataSource`. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:33:25.157477+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability required the absence of `com.mysql.cj.jdbc.admin.MiniAdmin` from the deserialization blacklist. The fix adding this class to the blacklist (commit dda513bd) was already present in upstream version 2.12.7 when TuxCare onboarded it. The blacklist is actively enforced via SubTypeValidator during Bean deserialization, preventing polymorphic instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability required the absence of `com.mysql.cj.jdbc.admin.MiniAdmin` from the deserialization blacklist. The fix adding this class to the blacklist (commit dda513bd) was already present in upstream version 2.12.7 when TuxCare onboarded it. The blacklist is actively enforced via SubTypeValidator during Bean deserialization, preventing polymorphic instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T18:36:38.648896+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerned the failure to block ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization in versions before 2.9.9.1. The fix (commit c9ef4a10d6f) was applied by upstream maintainer Tatu Saloranta on June 12, 2019, adding the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blockl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerned the failure to block ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization in versions before 2.9.9.1. The fix (commit c9ef4a10d6f) was applied by upstream maintainer Tatu Saloranta on June 12, 2019, adding the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blockl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T07:17:00.105487+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled and JDOM is in the classpath, allowing arbitrary file reads via polymorphic deserialization of XSLTransformer gadgets. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in version 2.12.7 when TuxCare onboarded it. The fix (commit 5f7c69bba...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled and JDOM is in the classpath, allowing arbitrary file reads via polymorphic deserialization of XSLTransformer gadgets. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in version 2.12.7 when TuxCare onboarded it. The fix (commit 5f7c69bba..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:10:20.881763+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.12.7-tuxcare.3. The vulnerability involves missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that could lead to arbitrary code execution via deserialization. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 by adding the ehcache class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.12.7, which TuxCare onboarded on 2026-10-30. The target contains the complete defense mechanism: the blacklist entry (lines 97-99) and validation logic (line 269) that blocks deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.12.7-tuxcare.3. The vulnerability involves missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that could lead to arbitrary code execution via deserialization. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 by adding the ehcache class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.12.7, which TuxCare onboarded on 2026-10-30. The target contains the complete defense mechanism: the blacklist entry (lines 97-99) and validation logic (line 269) that blocks deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 fix is already present in jackson-databind 2.12.7-tuxcare.4. The upstream vendor (FasterXML) applied the fix in commit ad418eeb97 on July 25, 2019, adding ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist in SubTypeValidator.java. This fix was already included in upstream release 2.12.7, which TuxCare onboarded on September 17, 2026. The vulnerable pattern (unblocked dangerous JNDI-capable classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 fix is already present in jackson-databind 2.12.7-tuxcare.4. The upstream vendor (FasterXML) applied the fix in commit ad418eeb97 on July 25, 2019, adding ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist in SubTypeValidator.java. This fix was already included in upstream release 2.12.7, which TuxCare onboarded on September 17, 2026. The vulnerable pattern (unblocked dangerous JNDI-capable classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:02.879946+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version is 2.12.7-tuxcare.4, which is significantly later than the fixed versions. The upstream vendor (FasterXML) fixed this polymorphic deserialization vulnerability by adding com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.7 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version is 2.12.7-tuxcare.4, which is significantly later than the fixed versions. The upstream vendor (FasterXML) fixed this polymorphic deserialization vulnerability by adding com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.7 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerns polymorphic deserialization of malicious objects using commons-configuration JNDI classes. The vendor fix adds two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to a deserialization blocklist in SubTypeValidator.java. These blocklist entries are present in the target at lines 113-114, actively enforced during bean deserialization, and were shipped in upstream release 2.12.7 before TuxCare onboarding. The fix commit (41b7f9b901) was authored by upstream maintainer Tatu Saloranta, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerns polymorphic deserialization of malicious objects using commons-configuration JNDI classes. The vendor fix adds two class names (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to a deserialization blocklist in SubTypeValidator.java. These blocklist entries are present in the target at lines 113-114, actively enforced during bean deserialization, and were shipped in upstream release 2.12.7 before TuxCare onboarding. The fix commit (41b7f9b901) was authored by upstream maintainer Tatu Saloranta, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.12.7-tuxcare.4. The vulnerability allowed polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The fix blocking this class was authored by upstream maintainer Tatu Saloranta in commit 998efd708284778f29d83d7962a9bd935c228317 (2019-09-19) and was already included in the upstream 2.12.7 release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:117.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.12.7-tuxcare.4. The vulnerability allowed polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to arbitrary code execution. The fix blocking this class was authored by upstream maintainer Tatu Saloranta in commit 998efd708284778f29d83d7962a9bd935c228317 (2019-09-19) and was already included in the upstream 2.12.7 release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:117.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:06:16.056250+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource allowing instantiation and property injection into attacker-specified classes. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in the upstream Jackson release 2.12.7 that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 73c1c2cc76e, which predates the first TuxCare commit by 2433 commits. The defense mechanism in validateSubType() effectively blocks polymorphic deserialization of HikariDataSource by throwing a JsonMappingException when this class is specified as a deserialization target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "The target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource allowing instantiation and property injection into attacker-specified classes. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in the upstream Jackson release 2.12.7 that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 73c1c2cc76e, which predates the first TuxCare commit by 2433 commits. The defense mechanism in validateSubType() effectively blocks polymorphic deserialization of HikariDataSource by throwing a JsonMappingException when this class is specified as a deserialization target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:05:45.890515+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing attackers to exploit commons-dbcp classes (PerUserPoolDataSource, SharedPoolDataSource) for RCE via JNDI injection. The target repository (jackson-databind 2.12.7-tuxcare.4) contains the complete upstream fix: these dangerous classes are explicitly blocked in SubTypeValidator.java lines 124-125. The fix was authored by upstream maintainer Tatu Saloranta on September 28, 2019 (commit 9593e16c) and was already present in upstream release 2.12.7 before TuxCare onboarded it on September 17, 2026. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing attackers to exploit commons-dbcp classes (PerUserPoolDataSource, SharedPoolDataSource) for RCE via JNDI injection. The target repository (jackson-databind 2.12.7-tuxcare.4) contains the complete upstream fix: these dangerous classes are explicitly blocked in SubTypeValidator.java lines 124-125. The fix was authored by upstream maintainer Tatu Saloranta on September 28, 2019 (commit 9593e16c) and was already present in upstream release 2.12.7 before TuxCare onboarded it on September 17, 2026. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:15:39.453186+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2019-16943. The vulnerability requires missing blocklist entries for three dangerous DataSource classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource) that enable RCE through polymorphic deserialization. These blocklist entries ARE PRESENT in SubTypeValidator.java lines 124-127. The fix was applied by upstream maintainer Tatu Saloranta in commit 9593e16cf5 and shipped in upstream release 2.12.7 before TuxCare onboarding. The SubTypeValidator singleton enforces the blocklist during all Bean deserialization and cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2019-16943. The vulnerability requires missing blocklist entries for three dangerous DataSource classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource) that enable RCE through polymorphic deserialization. These blocklist entries ARE PRESENT in SubTypeValidator.java lines 124-127. The fix was applied by upstream maintainer Tatu Saloranta in commit 9593e16cf5 and shipped in upstream release 2.12.7 before TuxCare onboarding. The SubTypeValidator singleton enforces the blocklist during all Bean deserialization and cannot be bypassed or disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:54.426721+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic deserialization gadget (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup). The target repository (jackson-databind 2.12.7-tuxcare.4) already contains the upstream fix (commit 191a4cdf87) which adds this class to the SubTypeValidator blocklist at line 99. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.12.7 release that TuxCare onboarded, making the vulnerable pattern not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic deserialization gadget (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup). The target repository (jackson-databind 2.12.7-tuxcare.4) already contains the upstream fix (commit 191a4cdf87) which adds this class to the SubTypeValidator blocklist at line 99. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.12.7 release that TuxCare onboarded, making the vulnerable pattern not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:48:21.924530+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 does not affect this target. The fix for this polymorphic deserialization vulnerability was already present in the upstream jackson-databind 2.12.7 release that TuxCare onboarded. The vulnerable log4j-extras gadget classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) are blacklisted in SubTypeValidator, preventing their deserialization when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 does not affect this target. The fix for this polymorphic deserialization vulnerability was already present in the upstream jackson-databind 2.12.7 release that TuxCare onboarded. The vulnerable log4j-extras gadget classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) are blacklisted in SubTypeValidator, preventing their deserialization when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7-tuxcare.4 is NOT vulnerable to CVE-2019-20330. The vulnerability affects versions before 2.9.10.2 and involves missing blocklist entries for dangerous ehcache classes (GenericJndiSelector, GlassfishSelector) that enable JNDI injection attacks. The fix was already present in upstream jackson-databind 2.12.7 (added by commit fc4214a8 authored by upstream maintainer Tatu Saloranta) before TuxCare onboarded this version. The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "Target jackson-databind 2.12.7-tuxcare.4 is NOT vulnerable to CVE-2019-20330. The vulnerability affects versions before 2.9.10.2 and involves missing blocklist entries for dangerous ehcache classes (GenericJndiSelector, GlassfishSelector) that enable JNDI injection attacks. The fix was already present in upstream jackson-databind 2.12.7 (added by commit fc4214a8 authored by upstream maintainer Tatu Saloranta) before TuxCare onboarded this version. The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:02:54.812243+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 addresses unsafe deserialization of ignite-jta classes that could lead to remote code execution through JNDI injection. The upstream fix (commit a424c038ba by Tatu Saloranta) added three dangerous class names to jackson-databind's deserialization blocklist: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already present in upstream jackson-databind 2.12.7, which TuxCare onboarded. The target version 2.12.7-tuxcare.4 contains these blocklist entries in SubTypeValidator.java lines 158-160. The validation mechanism is immutable and integrated into the main deserialization pipeline, preventing instantiation of these classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 addresses unsafe deserialization of ignite-jta classes that could lead to remote code execution through JNDI injection. The upstream fix (commit a424c038ba by Tatu Saloranta) added three dangerous class names to jackson-databind's deserialization blocklist: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was already present in upstream jackson-databind 2.12.7, which TuxCare onboarded. The target version 2.12.7-tuxcare.4 contains these blocklist entries in SubTypeValidator.java lines 158-160. The validation mechanism is immutable and integrated into the main deserialization pipeline, preventing instantiation of these classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is a Jackson deserialization gadget vulnerability involving org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The target repository (jackson-databind 2.12.7-tuxcare.4) contains the upstream fix that blacklists this gadget class in SubTypeValidator.java lines 162-164. The fix was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) in commit 592872f423 (March 15, 2020) and was already present in the upstream jackson-databind 2.12.7 release before TuxCare onboarded it on September 17, 2026 (commit 2db6b01a62). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is a Jackson deserialization gadget vulnerability involving org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The target repository (jackson-databind 2.12.7-tuxcare.4) contains the upstream fix that blacklists this gadget class in SubTypeValidator.java lines 162-164. The fix was authored by Tatu Saloranta (upstream maintainer, tatu.saloranta@iki.fi) in commit 592872f423 (March 15, 2020) and was already present in the upstream jackson-databind 2.12.7 release before TuxCare onboarded it on September 17, 2026 (commit 2db6b01a62). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:27:00.867186+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, related to the com.caucho.config.types.ResourceRef deserialization gadget. The target version 2.12.7-tuxcare.4 contains the upstream fix that denylists this class in SubTypeValidator.java (line 167). The fix was authored by upstream maintainer Tatu Saloranta and was already present in jackson-databind 2.12.7 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, related to the com.caucho.config.types.ResourceRef deserialization gadget. The target version 2.12.7-tuxcare.4 contains the upstream fix that denylists this class in SubTypeValidator.java (line 167). The fix was authored by upstream maintainer Tatu Saloranta and was already present in jackson-databind 2.12.7 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT vulnerable to CVE-2020-10968. The upstream fix that blocks deserialization of the org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class was already present in the upstream 2.12.7 release that TuxCare onboarded. The SubTypeValidator.java file contains the blacklist entries (lines 170-171) that prevent instantiation of the vulnerable gadget classes, blocking the attack chain before the goal (arbitrary code execution) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT vulnerable to CVE-2020-10968. The upstream fix that blocks deserialization of the org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class was already present in the upstream 2.12.7 release that TuxCare onboarded. The SubTypeValidator.java file contains the blacklist entries (lines 170-171) that prevent instantiation of the vulnerable gadget classes, blocking the attack chain before the goal (arbitrary code execution) can be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.12.7 is NOT affected by CVE-2020-10969. The vulnerability was fixed by upstream FasterXML in commit 4d038c9de0a (2020-03-03), which added javax.swing.JEditorPane to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.12.7 before TuxCare onboarded it (1516 commits before the TuxCare onboarding commit 2db6b01a62e). The blacklist entry at line 150 prevents deserialization of JEditorPane through the validateSubType method, which throws a JsonMappingException when a blacklisted class is encountered during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target jackson-databind version 2.12.7 is NOT affected by CVE-2020-10969. The vulnerability was fixed by upstream FasterXML in commit 4d038c9de0a (2020-03-03), which added javax.swing.JEditorPane to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.12.7 before TuxCare onboarded it (1516 commits before the TuxCare onboarding commit 2db6b01a62e). The blacklist entry at line 150 prevents deserialization of JEditorPane through the validateSubType method, which throws a JsonMappingException when a blacklisted class is encountered during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2020-11111. The vulnerability concerns deserialization of org.apache.activemq.* gadget classes that could enable code execution. The fix (adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.12.7 that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 173-183.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2020-11111. The vulnerability concerns deserialization of org.apache.activemq.* gadget classes that could enable code execution. The fix (adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.12.7 that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 173-183.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (blocking this class in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f and shipped in upstream version 2.9.10.4 (per CVE: \"before 2.9.10.4\"). Since the target version 2.12.7 is later than 2.9.10.4, the fix was already present in the upstream release that TuxCare onboarded. The blocking entry exists at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (blocking this class in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f and shipped in upstream version 2.9.10.4 (per CVE: \"before 2.9.10.4\"). Since the target version 2.12.7 is later than 2.9.10.4, the fix was already present in the upstream release that TuxCare onboarded. The blocking entry exists at SubTypeValidator.java:186.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 concerns a jackson-databind deserialization gadget (org.apache.openjpa.ee.WASRegistryManagedRuntime). The target repository jackson-databind version 2.12.7-tuxcare.4 is NOT affected because the upstream fix (commit e2ba12d5d) was already included in the upstream release 2.12.7 that TuxCare onboarded. The SubTypeValidator.java blacklist contains the dangerous class at line 84, preventing deserialization exploitation. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 concerns a jackson-databind deserialization gadget (org.apache.openjpa.ee.WASRegistryManagedRuntime). The target repository jackson-databind version 2.12.7-tuxcare.4 is NOT affected because the upstream fix (commit e2ba12d5d) was already included in the upstream release 2.12.7 that TuxCare onboarded. The SubTypeValidator.java blacklist contains the dangerous class at line 84, preventing deserialization exploitation. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2020-11619. The upstream fix (commit 113e89fb08) that blacklists the dangerous Spring AOP gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) was already present in upstream release 2.12.7, which TuxCare onboarded. The vulnerable deserialization pattern is not present in this version - the SubTypeValidator defense prevents instantiation of these gadget classes, blocking the attack chain before arbitrary code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2020-11619. The upstream fix (commit 113e89fb08) that blacklists the dangerous Spring AOP gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) was already present in upstream release 2.12.7, which TuxCare onboarded. The vulnerable deserialization pattern is not present in this version - the SubTypeValidator defense prevents instantiation of these gadget classes, blocking the attack chain before arbitrary code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2020-11620. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.jelly.impl.Embedded. The fix (blocklist entry) was added by upstream commit 77040d85e3 authored by Tatu Saloranta on 2020-04-07 and shipped in the upstream 2.12.7 release. When TuxCare onboarded version 2.12.7 on 2026-09-17, this fix was already present. The blocklist entry exists at SubTypeValidator.java line 189, preventing deserialization of the dangerous class through the validateSubType method integrated into BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "Target jackson-databind 2.12.7-tuxcare.4 is not affected by CVE-2020-11620. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.jelly.impl.Embedded. The fix (blocklist entry) was added by upstream commit 77040d85e3 authored by Tatu Saloranta on 2020-04-07 and shipped in the upstream 2.12.7 release. When TuxCare onboarded version 2.12.7 on 2026-09-17, this fix was already present. The blocklist entry exists at SubTypeValidator.java line 189, preventing deserialization of the dangerous class through the validateSubType method integrated into BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.12.7-tuxcare.4. The fix for this vulnerability was included in the upstream 2.12.7 release. The target contains the complete mitigation: all three gadget classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool, oadd.org.apache.commons.dbcp.datasources.PerUserPoolDataSource, oadd.org.apache.commons.dbcp.datasources.SharedPoolDataSource) are blacklisted in SubTypeValidator.java at lines 192-195. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.12.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.12.7-tuxcare.4. The fix for this vulnerability was included in the upstream 2.12.7 release. The target contains the complete mitigation: all three gadget classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool, oadd.org.apache.commons.dbcp.datasources.PerUserPoolDataSource, oadd.org.apache.commons.dbcp.datasources.SharedPoolDataSource) are blacklisted in SubTypeValidator.java at lines 192-195. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.12.7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves deserialization gadget chains using oracle.jms classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix, which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already present in upstream version 2.12.7 (commit 5c8642aeae by Tatu Saloranta, April 2020) before TuxCare onboarded this version. The target contains the complete fix at lines 200-204 of SubTypeValidator.java, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves deserialization gadget chains using oracle.jms classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix, which adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already present in upstream version 2.12.7 (commit 5c8642aeae by Tatu Saloranta, April 2020) before TuxCare onboarded this version. The target contains the complete fix at lines 200-204 of SubTypeValidator.java, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.12.7. The vulnerability involves deserialization of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class, which could enable JNDI injection attacks. The fix (blacklisting this class in SubTypeValidator) was added by upstream vendor commit 840eae2ca8 in May 2020 and was already present in the upstream 2.12.7 release. The dangerous class is blacklisted at line 119 of SubTypeValidator.java, and the validation is enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.12.7. The vulnerability involves deserialization of the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class, which could enable JNDI injection attacks. The fix (blacklisting this class in SubTypeValidator) was added by upstream vendor commit 840eae2ca8 in May 2020 and was already present in the upstream 2.12.7 release. The dangerous class is blacklisted at line 119 of SubTypeValidator.java, and the validation is enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind 2.x before 2.9.10.5. The target version is 2.12.7-tuxcare.4, which is significantly newer. The fix (adding org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blocklist) was introduced in upstream commit f6d9c664f6d481703138319f6a0f1fdbddb3a259 on June 13, 2020, by upstream author Tatu Saloranta. This fix was already present in the upstream 2.12.7 release that TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind 2.x before 2.9.10.5. The target version is 2.12.7-tuxcare.4, which is significantly newer. The fix (adding org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blocklist) was introduced in upstream commit f6d9c664f6d481703138319f6a0f1fdbddb3a259 on June 13, 2020, by upstream author Tatu Saloranta. This fix was already present in the upstream 2.12.7 release that TuxCare onboarded in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:19:44.520074+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in the upstream release 2.12.7 that TuxCare onboarded. The fix adds AnterosDBCPDataSource to the SubTypeValidator blocklist at line 147, preventing its instantiation during polymorphic deserialization. The fixing commit (3d97153944) by upstream author Tatu Saloranta predates the first TuxCare onboarding commit, confirming this is an upstream fix that shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in the upstream release 2.12.7 that TuxCare onboarded. The fix adds AnterosDBCPDataSource to the SubTypeValidator blocklist at line 147, preventing its instantiation during polymorphic deserialization. The fixing commit (3d97153944) by upstream author Tatu Saloranta predates the first TuxCare onboarding commit, confirming this is an upstream fix that shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:32.499277+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 does not affect jackson-databind 2.12.7-tuxcare.4. The vulnerability involves deserialization of the malicious gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration leading to JNDI injection. The upstream fix (blacklisting this class in SubTypeValidator.java) was already present in the upstream 2.12.7 release when TuxCare onboarded it. The target version is well beyond the affected range (before 2.6.7.5 and 2.7.x before 2.9.10.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 does not affect jackson-databind 2.12.7-tuxcare.4. The vulnerability involves deserialization of the malicious gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration leading to JNDI injection. The upstream fix (blacklisting this class in SubTypeValidator.java) was already present in the upstream 2.12.7 release when TuxCare onboarded it. The target version is well beyond the affected range (before 2.6.7.5 and 2.7.x before 2.9.10.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.12.7-tuxcare.4. The upstream fix (commit 612f971b78, issue #2589) was already included in the upstream jackson-databind 2.12.7 release before TuxCare onboarded it. The fix adds two XML parser security features to prevent external entity expansion: disallow-doctype-decl=true and load-external-dtd=false. These protections are present in the target at DOMDeserializer.java:43-49.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.12.7-tuxcare.4. The upstream fix (commit 612f971b78, issue #2589) was already included in the upstream jackson-databind 2.12.7 release before TuxCare onboarded it. The fix adds two XML parser security features to prevent external entity expansion: disallow-doctype-decl=true and load-external-dtd=false. These protections are present in the target at DOMDeserializer.java:43-49.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:21:16.269542+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for Apache Commons DBCP2 deserialization gadgets (PerUserPoolDataSource, SharedPoolDataSource). The target repository (jackson-databind 2.12.7-tuxcare.4) is not affected because the upstream fix was already present in the version that TuxCare onboarded. The fix (commit 41b8bdb5cc by upstream maintainer Tatu Saloranta) added these classes to the SubTypeValidator blacklist, preventing their deserialization and blocking the gadget chain exploitation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for Apache Commons DBCP2 deserialization gadgets (PerUserPoolDataSource, SharedPoolDataSource). The target repository (jackson-databind 2.12.7-tuxcare.4) is not affected because the upstream fix was already present in the version that TuxCare onboarded. The fix (commit 41b8bdb5cc by upstream maintainer Tatu Saloranta) added these classes to the SubTypeValidator blacklist, preventing their deserialization and blocking the gadget chain exploitation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:38:41.778029+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.12.7. The vulnerability affects versions before 2.9.10.8, where org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource were missing from the SubTypeValidator blocklist, allowing deserialization gadget attacks. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta, Dec 15 2020) added these classes to DEFAULT_NO_DESER_CLASS_NAMES. This fix was included in upstream release 2.12.1 and all subsequent versions. Target version 2.12.7 inherited this fix when TuxCare onboarded the upstream release. The blocklist is active by default and blocks deserialization of these dangerous classes before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.12.7. The vulnerability affects versions before 2.9.10.8, where org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource were missing from the SubTypeValidator blocklist, allowing deserialization gadget attacks. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta, Dec 15 2020) added these classes to DEFAULT_NO_DESER_CLASS_NAMES. This fix was included in upstream release 2.12.1 and all subsequent versions. Target version 2.12.7 inherited this fix when TuxCare onboarded the upstream release. The blocklist is active by default and blocks deserialization of these dangerous classes before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:25.795223+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 via a deserialization gadget (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool). The target version 2.12.7-tuxcare.4 contains the upstream fix (commit 1ca0388c2f by Tatu Saloranta) that was already present in the upstream 2.12.7 release when TuxCare onboarded it. The vulnerable gadget class is blacklisted in SubTypeValidator.java at line 240, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 via a deserialization gadget (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool). The target version 2.12.7-tuxcare.4 contains the upstream fix (commit 1ca0388c2f by Tatu Saloranta) that was already present in the upstream 2.12.7 release when TuxCare onboarded it. The vulnerable gadget class is blacklisted in SubTypeValidator.java at line 240, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:58.768798+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of DriverAdapterCPDS gadget classes. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in the upstream release 2.12.7 before TuxCare onboarded it. All five DriverAdapterCPDS class variants from the fix are present in SubTypeValidator's blocklist (lines 123, 193, 219, 228, 234), and the validation is actively enforced during deserialization via BeanDeserializerFactory.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of DriverAdapterCPDS gadget classes. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in the upstream release 2.12.7 before TuxCare onboarded it. All five DriverAdapterCPDS class variants from the fix are present in SubTypeValidator's blocklist (lines 123, 193, 219, 228, 234), and the validation is actively enforced during deserialization via BeanDeserializerFactory.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The upstream fix (commit 3ded28aece) that adds these classes to Jackson's deserialization blacklist was already present in the jackson-databind 2.12.7 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java, and the enforcement mechanism actively prevents their deserialization with a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target repository jackson-databind 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2020-36180. The vulnerability involves deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The upstream fix (commit 3ded28aece) that adds these classes to Jackson's deserialization blacklist was already present in the jackson-databind 2.12.7 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java, and the enforcement mechanism actively prevents their deserialization with a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:41:26.898836+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.7-tuxcare.4) is not affected by CVE-2020-36181. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and similar DBCP classes that could enable arbitrary object instantiation. The upstream fix (commit 3ded28aece by Tatu Saloranta) added these classes to the SubTypeValidator deny-list, blocking their instantiation during deserialization. This fix was already present in the upstream 2.12.7 release that TuxCare onboarded (commit 2db6b01a62), making it part of HEAD. CVE-2020-36181 affects versions before 2.9.10.8; the target version 2.12.7 is well beyond the vulnerable range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.7-tuxcare.4) is not affected by CVE-2020-36181. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and similar DBCP classes that could enable arbitrary object instantiation. The upstream fix (commit 3ded28aece by Tatu Saloranta) added these classes to the SubTypeValidator deny-list, blocking their instantiation during deserialization. This fix was already present in the upstream 2.12.7 release that TuxCare onboarded (commit 2db6b01a62), making it part of HEAD. CVE-2020-36181 affects versions before 2.9.10.8; the target version 2.12.7 is well beyond the vulnerable range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:30.909844+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects Jackson deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT vulnerable because the fix was already included in the upstream Jackson 2.12.7 release. The blacklist entry for this class was added by upstream commit 3ded28aece (Dec 31, 2020) by maintainer Tatu Saloranta, which was part of the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 affects Jackson deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository (jackson-databind 2.12.7-tuxcare.4) is NOT vulnerable because the fix was already included in the upstream Jackson 2.12.7 release. The blacklist entry for this class was added by upstream commit 3ded28aece (Dec 31, 2020) by maintainer Tatu Saloranta, which was part of the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:56.878680+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7 contains the upstream vendor's fix for CVE-2020-36183. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the gadget class \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\", which can trigger JNDI injection for remote code execution. The fix adds this class name to SubTypeValidator's blacklist (line 243 of SubTypeValidator.java), preventing its deserialization. Commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 by Tatu Saloranta (upstream maintainer tatu.saloranta@iki.fi) introduced this fix, and it was already present in the upstream 2.12.7 release before TuxCare onboarded it. This is not a TuxCare backport but an upstream fix that shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "Target version 2.12.7 contains the upstream vendor's fix for CVE-2020-36183. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the gadget class \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\", which can trigger JNDI injection for remote code execution. The fix adds this class name to SubTypeValidator's blacklist (line 243 of SubTypeValidator.java), preventing its deserialization. Commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 by Tatu Saloranta (upstream maintainer tatu.saloranta@iki.fi) introduced this fix, and it was already present in the upstream 2.12.7 release before TuxCare onboarded it. This is not a TuxCare backport but an upstream fix that shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:11.887724+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.12.7-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource). The upstream fix, which blacklists these classes in SubTypeValidator, was already present in the upstream 2.12.7 release that TuxCare onboarded. The fix was committed on Dec 26, 2020 (commit 567194c) by upstream maintainer Tatu Saloranta, 1433 commits before TuxCare's onboarding commit. The blacklist is active by default and prevents deserialization of these gadget classes, blocking the attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.12.7-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (PerUserPoolDataSource and SharedPoolDataSource). The upstream fix, which blacklists these classes in SubTypeValidator, was already present in the upstream 2.12.7 release that TuxCare onboarded. The fix was committed on Dec 26, 2020 (commit 567194c) by upstream maintainer Tatu Saloranta, 1433 commits before TuxCare's onboarding commit. The blacklist is active by default and prevents deserialization of these gadget classes, blocking the attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a) that adds these classes to the deserialization blocklist was already included in the upstream jackson-databind 2.12.7 release that TuxCare onboarded. The target's SubTypeValidator.java contains the required blocklist entries at lines 232-236, preventing exploitation of this gadget chain. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a) that adds these classes to the deserialization blocklist was already included in the upstream jackson-databind 2.12.7 release that TuxCare onboarded. The target's SubTypeValidator.java contains the required blocklist entries at lines 232-236, preventing exploitation of this gadget chain. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:31:06.545047+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability relates to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix, which adds these classes to the deserialization blocklist in SubTypeValidator.java, was already included in the upstream 2.12.7 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability relates to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix, which adds these classes to the deserialization blocklist in SubTypeValidator.java, was already included in the upstream 2.12.7 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:45:08.181929+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not present in jackson-databind 2.12.7-tuxcare.4. The fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was included in the upstream 2.12.7 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java (lines 229-230) and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is not present in jackson-databind 2.12.7-tuxcare.4. The fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was included in the upstream 2.12.7 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java (lines 229-230) and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:50:34.321769+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2020-36188. The vulnerability concerns deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The upstream fix (commit 33d96c13fe by Tatu Saloranta) was already present in jackson-databind 2.12.7 when TuxCare onboarded this version. The fix adds the vulnerable class to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which actively prevents deserialization of this gadget class. The validator is enforced in the main deserialization path via BeanDeserializerFactory._validateSubType(), rejecting any attempt to deserialize the CVE-mentioned class with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "The target jackson-databind version 2.12.7-tuxcare.4 is NOT AFFECTED by CVE-2020-36188. The vulnerability concerns deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The upstream fix (commit 33d96c13fe by Tatu Saloranta) was already present in jackson-databind 2.12.7 when TuxCare onboarded this version. The fix adds the vulnerable class to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which actively prevents deserialization of this gadget class. The validator is enforced in the main deserialization path via BeanDeserializerFactory._validateSubType(), rejecting any attempt to deserialize the CVE-mentioned class with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:01:12.948527+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The target repository (jackson-databind 2.12.7-tuxcare.3) contains the upstream fix commit 33d96c13fe from December 2020 by Tatu Saloranta, which added these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.12.7 before TuxCare's onboarding commit. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The target repository (jackson-databind 2.12.7-tuxcare.3) contains the upstream fix commit 33d96c13fe from December 2020 by Tatu Saloranta, which added these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.12.7 before TuxCare's onboarding commit. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.12.7. The vulnerability was fixed by upstream vendor FasterXML in version 2.12.6.1 (commit 83b928dab9, March 26, 2022). The fix adds a MAX_DEPTH limit of 1000 levels and depth tracking to UntypedObjectDeserializer.Vanilla.deserialize(), preventing stack exhaustion from deeply nested JSON. TuxCare onboarded upstream version 2.12.7 which already contained this fix, but did not author the fix themselves.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.12.7. The vulnerability was fixed by upstream vendor FasterXML in version 2.12.6.1 (commit 83b928dab9, March 26, 2022). The fix adds a MAX_DEPTH limit of 1000 levels and depth tracking to UntypedObjectDeserializer.Vanilla.deserialize(), preventing stack exhaustion from deeply nested JSON. TuxCare onboarded upstream version 2.12.7 which already contained this fix, but did not author the fix themselves."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:10:12.627525+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.7-tuxcare.4 is not affected by CVE-2020-8840. The upstream vendor fix that blocks org.apache.xbean.propertyeditor.JndiConverter from deserialization was already included in the upstream 2.12.7 release before TuxCare onboarded it. The blocking entry exists at SubTypeValidator.java:138 and is enforced during all polymorphic type deserialization, preventing the JNDI gadget attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "Target version 2.12.7-tuxcare.4 is not affected by CVE-2020-8840. The upstream vendor fix that blocks org.apache.xbean.propertyeditor.JndiConverter from deserialization was already included in the upstream 2.12.7 release before TuxCare onboarded it. The blocking entry exists at SubTypeValidator.java:138 and is enforced during all polymorphic type deserialization, preventing the JNDI gadget attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546: Target jackson-databind 2.12.7 is NOT AFFECTED. The vulnerability involves missing blocklist entries for deserialization gadgets (specifically org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig). The fix was already present in upstream 2.12.7 when TuxCare onboarded it. SubTypeValidator.java line 141 contains the required blocklist entry, added by upstream commit 9f4e97019fb (author: Tatu Saloranta, 2020-02-29). This upstream fix shipped in the original 2.12.7 release, predating TuxCare's onboarding commit 2db6b01a62e by 1517 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546: Target jackson-databind 2.12.7 is NOT AFFECTED. The vulnerability involves missing blocklist entries for deserialization gadgets (specifically org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig). The fix was already present in upstream 2.12.7 when TuxCare onboarded it. SubTypeValidator.java line 141 contains the required blocklist entry, added by upstream commit 9f4e97019fb (author: Tatu Saloranta, 2020-02-29). This upstream fix shipped in the original 2.12.7 release, predating TuxCare's onboarding commit 2db6b01a62e by 1517 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:43.036497+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves polymorphic deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig, which could enable arbitrary code execution. The upstream fix (commit 9f4e97019f by Tatu Saloranta, dated Feb 29, 2020) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.12.7 release (released Feb 2021) that TuxCare onboarded, so the vulnerable code pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves polymorphic deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig, which could enable arbitrary code execution. The upstream fix (commit 9f4e97019f by Tatu Saloranta, dated Feb 29, 2020) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.12.7 release (released Feb 2021) that TuxCare onboarded, so the vulnerable code pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.7-tuxcare.4 is NOT affected by CVE-2020-9548. The vulnerability involves deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPConfig via Jackson's polymorphic typing feature. The upstream fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2) adds this class to the SubTypeValidator blacklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing its deserialization. This fix was already present in upstream version 2.12.7 before TuxCare onboarded it, as confirmed by verifying that the fix commit is an ancestor of the first TuxCare onboarding commit (2db6b01a62e0c2709f6b965215ed7770aeaf27c9). The vulnerable code pattern does not exist in the target because the upstream vendor shipped the fix in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "The target jackson-databind 2.12.7-tuxcare.4 is NOT affected by CVE-2020-9548. The vulnerability involves deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPConfig via Jackson's polymorphic typing feature. The upstream fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2) adds this class to the SubTypeValidator blacklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing its deserialization. This fix was already present in upstream version 2.12.7 before TuxCare onboarded it, as confirmed by verifying that the fix commit is an ancestor of the first TuxCare onboarding commit (2db6b01a62e0c2709f6b965215ed7770aeaf27c9). The vulnerable code pattern does not exist in the target because the upstream vendor shipped the fix in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:02.714408+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves the javax.swing.JTextPane gadget class being exploitable through Jackson's polymorphic deserialization mechanism. The fix (blocking JTextPane in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 7dbf51bf78 and shipped in the upstream 2.12.7 release that TuxCare later onboarded. The defense code is present at SubTypeValidator.java:151, blocking deserialization of javax.swing.JTextPane before any attacker-controlled type instantiation can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability involves the javax.swing.JTextPane gadget class being exploitable through Jackson's polymorphic deserialization mechanism. The fix (blocking JTextPane in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 7dbf51bf78 and shipped in the upstream 2.12.7 release that TuxCare later onboarded. The defense code is present at SubTypeValidator.java:151, blocking deserialization of javax.swing.JTextPane before any attacker-controlled type instantiation can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability (DoS via 2GB heap allocation in JDK deserialization of JsonNode) was fixed by upstream maintainer Tatu Saloranta in commit 3ccde7d938 before the 2.12.6 release. The CVE states versions \"before 2.12.6\" are affected; this target is 2.12.7, which includes the upstream fix. The fix limits eager allocation to 100KB and uses chunked reading for larger data, preventing malicious length fields from causing memory exhaustion. The vulnerable code pattern (direct allocation: `json = new byte[len]`) is absent from NodeSerialization.java; the protected pattern with LONGEST_EAGER_ALLOC and _read() method is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 is NOT present in jackson-databind 2.12.7-tuxcare.4. The vulnerability (DoS via 2GB heap allocation in JDK deserialization of JsonNode) was fixed by upstream maintainer Tatu Saloranta in commit 3ccde7d938 before the 2.12.6 release. The CVE states versions \"before 2.12.6\" are affected; this target is 2.12.7, which includes the upstream fix. The fix limits eager allocation to 100KB and uses chunked reading for larger data, preventing malicious length fields from causing memory exhaustion. The vulnerable code pattern (direct allocation: `json = new byte[len]`) is absent from NodeSerialization.java; the protected pattern with LONGEST_EAGER_ALLOC and _read() method is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:42:09.993598+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:32:10.500746+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.12.7-tuxcare.4 (released May 2022) is NOT AFFECTED by CVE-2026-54517. The vulnerability was introduced by upstream commit ff8c5a22c6 (#5237) on August 12, 2025, which enabled setterless/mergeable properties to be buffered in property-based creator paths. This change occurred 3+ years after 2.12.7's release. In 2.12.7, setterless properties cannot be buffered and applied because Setter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.7-tuxcare.4 (released May 2022) is NOT AFFECTED by CVE-2026-54517. The vulnerability was introduced by upstream commit ff8c5a22c6 (#5237) on August 12, 2025, which enabled setterless/mergeable properties to be buffered in property-based creator paths. This change occurred 3+ years after 2.12.7's release. In 2.12.7, setterless properties cannot be buffered and applied because Setter..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:05:23.844457+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.12.7 is not affected by CVE-2026-54518. The vulnerability requires @JsonUnwrapped + @JsonCreator combination support, which was introduced 2.5 years after 2.12.7's release (May 2022). Version 2.12.7 explicitly rejects this combination with exception: \"Cannot define Creator property as @JsonUnwrapped: combination not yet supported\" (BeanDeserializerBase.java:934-938). The vulnerable me...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.7 is not affected by CVE-2026-54518. The vulnerability requires @JsonUnwrapped + @JsonCreator combination support, which was introduced 2.5 years after 2.12.7's release (May 2022). Version 2.12.7 explicitly rejects this combination with exception: \"Cannot define Creator property as @JsonUnwrapped: combination not yet supported\" (BeanDeserializerBase.java:934-938). The vulnerable me..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:54:13.646678+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:42:09.993598+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T14:03:00.213493+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.7-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:42:09.993598+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:42:09.993598+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:42:09.993598+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:42:09.993598+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.7-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T11:41:45.095324+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.7-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}