{
  "@id": "urn:uuid:ecff1ca3-8c1b-4c4b-90a6-4bfcdb336740",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 59,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:21:41.442666+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:59.149107+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability concerns unsafe deserialization of attacker-controlled class names leading to code execution. The upstream vendor (FasterXML) fixed this by adding dangerous classes to a blacklist in databind#1680 and databind#1737. Both fixes (commits e8f043d1aa and ddfddfba64, authored by Tatu Saloranta) were already present in the upstream release 2.13.1 when TuxCare onboarded it. The target contains the comprehensive blacklist in SubTypeValidator.java with all CVE-2017-15095 classes plus many additional entries from later CVEs. The defense is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory during bean deserialization. Since the fix was authored by the upstream vendor (not TuxCare) and shipped in the upstream release, this is classified as not_affected with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability concerns unsafe deserialization of attacker-controlled class names leading to code execution. The upstream vendor (FasterXML) fixed this by adding dangerous classes to a blacklist in databind#1680 and databind#1737. Both fixes (commits e8f043d1aa and ddfddfba64, authored by Tatu Saloranta) were already present in the upstream release 2.13.1 when TuxCare onboarded it. The target contains the comprehensive blacklist in SubTypeValidator.java with all CVE-2017-15095 classes plus many additional entries from later CVEs. The defense is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory during bean deserialization. Since the fix was authored by the upstream vendor (not TuxCare) and shipped in the upstream release, this is classified as not_affected with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:47:06.064229+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2017-17485. The vulnerability allowed unauthenticated remote code execution via polymorphic deserialization of dangerous classes when using ObjectMapper.readValue(). The fixes (git commits 2235894210 and e865a7a446) were authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.13.1 release, prior to TuxCare onboarding (commit 254a19735). The defense is present and functional: SubTypeValidator maintains a comprehensive blacklist of dangerous classes including all CVE-2017-17485 targets (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, BCEL ClassLoader, plus hierarchy checks for Spring AbstractPointcutAdvisor/AbstractApplicationContext and C3P0 DataSource classes). BeanDeserializerFactory calls SubTypeValidator.validateSubType() during bean deserialization, rejecting blacklisted types with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "The target jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2017-17485. The vulnerability allowed unauthenticated remote code execution via polymorphic deserialization of dangerous classes when using ObjectMapper.readValue(). The fixes (git commits 2235894210 and e865a7a446) were authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.13.1 release, prior to TuxCare onboarding (commit 254a19735). The defense is present and functional: SubTypeValidator maintains a comprehensive blacklist of dangerous classes including all CVE-2017-17485 targets (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, BCEL ClassLoader, plus hierarchy checks for Spring AbstractPointcutAdvisor/AbstractApplicationContext and C3P0 DataSource classes). BeanDeserializerFactory calls SubTypeValidator.validateSubType() during bean deserialization, rejecting blacklisted types with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:33:25.079742+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.13.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in earlier versions (2.6.7.1, 2.7.9.1, 2.8.9) by introducing SubTypeValidator with a blocklist of dangerous classes. The fix was already included in the upstream 2.13.1 release that TuxCare onboarded, so the vulnerable deserialization pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.13.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in earlier versions (2.6.7.1, 2.7.9.1, 2.8.9) by introducing SubTypeValidator with a blocklist of dangerous classes. The fix was already included in the upstream 2.13.1 release that TuxCare onboarded, so the vulnerable deserialization pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:14.873847+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.13.1. The vulnerability allowed deserialization of org.apache.ibatis.parsing.XPathParser via Jackson default typing, enabling XXE-based data exfiltration. The fix (blacklisting XPathParser in SubTypeValidator) was added by upstream maintainer Tatu Saloranta in commit 27b4defc270 (2018-05-10) and shipped in upstream jackson-databind 2.13.1 before TuxCare onboarded this version. The blacklist entry is present at SubTypeValidator.java:65. No TuxCare backport was needed for 2.13.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.13.1. The vulnerability allowed deserialization of org.apache.ibatis.parsing.XPathParser via Jackson default typing, enabling XXE-based data exfiltration. The fix (blacklisting XPathParser in SubTypeValidator) was added by upstream maintainer Tatu Saloranta in commit 27b4defc270 (2018-05-10) and shipped in upstream jackson-databind 2.13.1 before TuxCare onboarded this version. The blacklist entry is present at SubTypeValidator.java:65. No TuxCare backport was needed for 2.13.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind 2.13.1-tuxcare.3. The fix for this CVE (blacklisting jodd.db.connection.DataSourceConnectionProvider and Oracle JDBC classes in SubTypeValidator) was already present in the upstream 2.13.1 release that TuxCare onboarded. The vulnerable deserialization gadget classes are blocked at lines 67-72 of SubTypeValidator.java, preventing exploitation via Default Typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind 2.13.1-tuxcare.3. The fix for this CVE (blacklisting jodd.db.connection.DataSourceConnectionProvider and Oracle JDBC classes in SubTypeValidator) was already present in the upstream 2.13.1 release that TuxCare onboarded. The vulnerable deserialization gadget classes are blocked at lines 67-72 of SubTypeValidator.java, preventing exploitation via Default Typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.13.1. The vulnerability required Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to be deserializable when Default Typing is enabled. The upstream fix added these classes to the deserialization blocklist in SubTypeValidator.java, and this fix was already included in the upstream 2.13.1 release that TuxCare onboarded. The fix commit (28badf7ef60) was authored by upstream maintainer Tatu Saloranta in June 2018 and is an ancestor of the first TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.13.1. The vulnerability required Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to be deserializable when Default Typing is enabled. The upstream fix added these classes to the deserialization blocklist in SubTypeValidator.java, and this fix was already included in the upstream 2.13.1 release that TuxCare onboarded. The fix commit (28badf7ef60) was authored by upstream maintainer Tatu Saloranta in June 2018 and is an ancestor of the first TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) that blocks org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream release 2.13.1 before TuxCare onboarded it. The vulnerable pattern is absent from the target because SubTypeValidator.java (lines 74-78) contains the required blocklist entries that prevent deserialization of the dangerous classes mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The upstream fix (commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by Tatu Saloranta) that blocks org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream release 2.13.1 before TuxCare onboarded it. The vulnerable pattern is absent from the target because SubTypeValidator.java (lines 74-78) contains the required blocklist entries that prevent deserialization of the dangerous classes mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:03:43.787457+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5. The target version 2.13.1-tuxcare.3 is significantly newer and already contains the upstream fix. The fix (blocking BlazeDS-related classes from polymorphic deserialization) was shipped in upstream jackson-databind 2.13.1 before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5. The target version 2.13.1-tuxcare.3 is significantly newer and already contains the upstream fix. The fix (blocking BlazeDS-related classes from polymorphic deserialization) was shipped in upstream jackson-databind 2.13.1 before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:01.555768+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability involves polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks or external resource access. The fix blocking these classes is present in SubTypeValidator.java lines 75-78. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e and was already included in the upstream jackson-databind 2.13.1 release that TuxCare onboarded. The CVE affects versions \"2.x before 2.9.7\" and the target version 2.13.1 is well beyond that range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target repository jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability involves polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks or external resource access. The fix blocking these classes is present in SubTypeValidator.java lines 75-78. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e and was already included in the upstream jackson-databind 2.13.1 release that TuxCare onboarded. The CVE affects versions \"2.x before 2.9.7\" and the target version 2.13.1 is well beyond that range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:54.716958+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability affects jackson-databind 2.x before 2.9.7, allowing SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class. The upstream vendor (FasterXML) fixed this in version 2.9.7 (August 2018) by adding HandlerResolverImpl to the deserialization blacklist. The target version 2.13.1 (December 2021) already contains this upstream fix, as verified by finding the blacklist entry at SubTypeValidator.java:78. The fix commit (0899726ec3) was authored by Tatu Saloranta (upstream maintainer) and was present in the upstream release before TuxCare's onboarding commit, making this an upstream-provided mitigation rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability affects jackson-databind 2.x before 2.9.7, allowing SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class. The upstream vendor (FasterXML) fixed this in version 2.9.7 (August 2018) by adding HandlerResolverImpl to the deserialization blacklist. The target version 2.13.1 (December 2021) already contains this upstream fix, as verified by finding the blacklist entry at SubTypeValidator.java:78. The fix commit (0899726ec3) was authored by Tatu Saloranta (upstream maintainer) and was present in the upstream release before TuxCare's onboarding commit, making this an upstream-provided mitigation rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.1-tuxcare.3 is not affected by CVE-2018-19360. The vulnerability exploits the absence of blocking for org.apache.axis2.transport.jms.JMSOutTransportInfo in the polymorphic deserialization deny list, allowing attackers to achieve code execution via deserialization gadgets. The fix (adding this class to DEFAULT_NO_DESER_CLASS_NAMES) was included in upstream jackson-databind 2.9.8 (November 2018) and is present in the target's 2.13.1 release. The defense is immutable and checked during all polymorphic deserialization operations via SubTypeValidator.validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "Target jackson-databind 2.13.1-tuxcare.3 is not affected by CVE-2018-19360. The vulnerability exploits the absence of blocking for org.apache.axis2.transport.jms.JMSOutTransportInfo in the polymorphic deserialization deny list, allowing attackers to achieve code execution via deserialization gadgets. The fix (adding this class to DEFAULT_NO_DESER_CLASS_NAMES) was included in upstream jackson-databind 2.9.8 (November 2018) and is present in the target's 2.13.1 release. The defense is immutable and checked during all polymorphic deserialization operations via SubTypeValidator.validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:32.199516+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.13.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.8 by adding OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) to the polymorphic deserialization blocklist in SubTypeValidator.java. The fix was authored by Tatu Saloranta in commit 72cd4025a2 and was already present in the upstream release when TuxCare onboarded version 2.13.1. The target version is not vulnerable because the malicious OpenJPA gadget classes are blocked from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.13.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.8 by adding OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) to the polymorphic deserialization blocklist in SubTypeValidator.java. The fix was authored by Tatu Saloranta in commit 72cd4025a2 and was already present in the upstream release when TuxCare onboarded version 2.13.1. The target version is not vulnerable because the malicious OpenJPA gadget classes are blocked from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:27:45.237635+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.13.1 is NOT affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of four dangerous third-party classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo). The fix blocking these classes is already present in SubTypeValidator.java lines 81-85. This fix was authored by upstream (Tatu Saloranta, tatu.saloranta@iki.fi) and shipped in the upstream release before TuxCare onboarded version 2.13.1, making this an upstream-delivered fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target repository jackson-databind 2.13.1 is NOT affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of four dangerous third-party classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo). The fix blocking these classes is already present in SubTypeValidator.java lines 81-85. This fix was authored by upstream (Tatu Saloranta, tatu.saloranta@iki.fi) and shipped in the upstream release before TuxCare onboarded version 2.13.1, making this an upstream-delivered fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 does not affect jackson-databind 2.13.1. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist in versions through 2.8.11 and 2.9.x through 2.9.3. The upstream fix (commit 038b471e2e, dated 2018-01-21) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix first appeared in upstream version 2.10.0 and was already present in the upstream 2.13.1 release that TuxCare onboarded, making the target version immune to this specific exploit vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 does not affect jackson-databind 2.13.1. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist in versions through 2.8.11 and 2.9.x through 2.9.3. The upstream fix (commit 038b471e2e, dated 2018-01-21) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix first appeared in upstream version 2.10.0 and was already present in the upstream 2.13.1 release that TuxCare onboarded, making the target version immune to this specific exploit vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:42.857553+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes when default typing was enabled. The upstream fix (commit 6799f8f10c by Tatu Saloranta) blocks all c3p0 classes ending with \"DataSource\" and was already included in the upstream 2.13.1 release that TuxCare onboarded. The defense is present in SubTypeValidator.java at lines 288-297 and is properly invoked during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes when default typing was enabled. The upstream fix (commit 6799f8f10c by Tatu Saloranta) blocks all c3p0 classes ending with \"DataSource\" and was already included in the upstream 2.13.1 release that TuxCare onboarded. The defense is present in SubTypeValidator.java at lines 288-297 and is properly invoked during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:37:30.400386+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.13.1 already contains the upstream fix that blocks com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization. The fix was introduced by upstream commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 (authored by Tatu Saloranta) and was already present in the upstream release before TuxCare onboarded version 2.11.2. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.13.1 already contains the upstream fix that blocks com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization. The fix was introduced by upstream commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 (authored by Tatu Saloranta) and was already present in the upstream release before TuxCare onboarded version 2.11.2. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T18:48:00.197216+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the dangerous class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. However, the upstream vendor fix (commit c9ef4a10d6) that adds this class to the deserialization blocklist was already present in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2019-12384. The vulnerability involves polymorphic deserialization of the dangerous class ch.qos.logback.core.db.DriverManagerConnectionSource, which could lead to remote code execution. However, the upstream vendor fix (commit c9ef4a10d6) that adds this class to the deserialization blocklist was already present in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T07:28:00.169574+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT affected by CVE-2019-12814. The vulnerability, which allows reading arbitrary local files via polymorphic deserialization of JDOM XSLTransformer classes, has been fixed in the upstream release that TuxCare onboarded. The fix (commit 5f7c69bba0 by Tatu Saloranta) adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT affected by CVE-2019-12814. The vulnerability, which allows reading arbitrary local files via polymorphic deserialization of JDOM XSLTransformer classes, has been fixed in the upstream release that TuxCare onboarded. The fix (commit 5f7c69bba0 by Tatu Saloranta) adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTra..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.13.1-tuxcare.3. The fix was already included in the upstream jackson-databind 2.13.1 release that TuxCare onboarded. The dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup is blocklisted in SubTypeValidator.java at line 98, preventing its deserialization and blocking the attack path to remote code execution. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta and was already present before the first TuxCare commit (254a197350522110d9360b3a6788675bae351eff \"Onboard version 2.13.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.13.1-tuxcare.3. The fix was already included in the upstream jackson-databind 2.13.1 release that TuxCare onboarded. The dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup is blocklisted in SubTypeValidator.java at line 98, preventing its deserialization and blocking the attack path to remote code execution. The fix commit (ad418eeb974e357f2797aef64aa0e3ffaaa6125b) was authored by upstream maintainer Tatu Saloranta and was already present before the first TuxCare commit (254a197350522110d9360b3a6788675bae351eff \"Onboard version 2.13.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:43:26.013143+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2019-14439. The vulnerability concerns polymorphic deserialization of the dangerous logback class ch.qos.logback.core.db.JNDIConnectionSource, which could lead to arbitrary code execution via JNDI injection. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 by adding the class to a deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.1 release that TuxCare onboarded (commit 254a19735...), making the vulnerable pattern absent from the target. The blacklist entry at line 102 of SubTypeValidator.java blocks instantiation of this class during polymorphic deserialization, preventing the attack chain from reaching the arbitrary code execution goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "Target version jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2019-14439. The vulnerability concerns polymorphic deserialization of the dangerous logback class ch.qos.logback.core.db.JNDIConnectionSource, which could lead to arbitrary code execution via JNDI injection. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 by adding the class to a deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.1 release that TuxCare onboarded (commit 254a19735...), making the vulnerable pattern absent from the target. The blacklist entry at line 102 of SubTypeValidator.java blocks instantiation of this class during polymorphic deserialization, preventing the attack chain from reaching the arbitrary code execution goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:51:48.439137+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.1-tuxcare.3 is NOT affected by CVE-2019-14540. The vulnerability pattern (absence of HikariConfig/HikariDataSource blocklist entries) is not present because the upstream vendor (FasterXML) already added these blocklist entries in commits d4983c740fec and 73c1c2cc76e6 before the 2.13.1 release. These fixes were included in the upstream release that TuxCare onboarded, not applied as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "The target jackson-databind 2.13.1-tuxcare.3 is NOT affected by CVE-2019-14540. The vulnerability pattern (absence of HikariConfig/HikariDataSource blocklist entries) is not present because the upstream vendor (FasterXML) already added these blocklist entries in commits d4983c740fec and 73c1c2cc76e6 before the 2.13.1 release. These fixes were included in the upstream release that TuxCare onboarded, not applied as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:59:41.286358+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions that permit polymorphic deserialization of malicious objects using commons-configuration JNDI classes. The upstream fix (commit 41b7f9b901) adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.1 release that TuxCare onboarded (commit 254a197350). The target version 2.13.1-tuxcare.3 is not affected because the vulnerable code pattern is not present\u2014the dangerous classes are blocklisted and deserialization of these types is prevented by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 affects jackson-databind versions that permit polymorphic deserialization of malicious objects using commons-configuration JNDI classes. The upstream fix (commit 41b7f9b901) adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.1 release that TuxCare onboarded (commit 254a197350). The target version 2.13.1-tuxcare.3 is not affected because the vulnerable code pattern is not present\u2014the dangerous classes are blocklisted and deserialization of these types is prevented by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.13.1. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to arbitrary code execution. The upstream fix (commit 998efd7082, Sept 2019) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was included in upstream release 2.10.0 and is present in the target version 2.13.1, which TuxCare onboarded from upstream. The blocklist entry exists at line 117 of SubTypeValidator.java, confirming the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.13.1. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to arbitrary code execution. The upstream fix (commit 998efd7082, Sept 2019) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was included in upstream release 2.10.0 and is present in the target version 2.13.1, which TuxCare onboarded from upstream. The blocklist entry exists at line 117 of SubTypeValidator.java, confirming the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:06.581572+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could allow arbitrary code execution. The fix blocking HikariDataSource was authored by upstream maintainer Tatu Saloranta (commit 73c1c2cc76) and was already included in upstream release 2.13.1 before TuxCare onboarded this version (onboarding commit 254a197350522110d9360b3a6788675bae351eff). The SubTypeValidator.java file at line 107 contains the blocklist entry preventing HikariDataSource deserialization, and this validator is integrated into the critical deserialization path at BeanDeserializerFactory.java line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could allow arbitrary code execution. The fix blocking HikariDataSource was authored by upstream maintainer Tatu Saloranta (commit 73c1c2cc76) and was already included in upstream release 2.13.1 before TuxCare onboarded this version (onboarding commit 254a197350522110d9360b3a6788675bae351eff). The SubTypeValidator.java file at line 107 contains the blocklist entry preventing HikariDataSource deserialization, and this validator is integrated into the critical deserialization path at BeanDeserializerFactory.java line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:10.548488+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing RCE via commons-dbcp datasource gadget chains. The target version (2.13.1-tuxcare.3) is NOT affected because the upstream fix was already present in the jackson-databind 2.13.1 release that TuxCare onboarded. The fix blocks deserialization of org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource by adding them to SubTypeValidator's blacklist. Upstream commits 9593e16c and 328a0f83 (both by Tatu Saloranta, September 2019) implemented this defense before the 2.13.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing RCE via commons-dbcp datasource gadget chains. The target version (2.13.1-tuxcare.3) is NOT affected because the upstream fix was already present in the jackson-databind 2.13.1 release that TuxCare onboarded. The fix blocks deserialization of org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource by adding them to SubTypeValidator's blacklist. Upstream commits 9593e16c and 328a0f83 (both by Tatu Saloranta, September 2019) implemented this defense before the 2.13.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:19:24.126381+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3, involving polymorphic typing issues with p6spy and commons-dbcp DataSource gadget classes. The target jackson-databind 2.13.1 is NOT affected because the upstream vendor fix (adding P6DataSource and commons-dbcp DataSource classes to the SubTypeValidator blocklist) was already included in the upstream 2.13.1 release. The fix was committed by Tatu Saloranta on 2019-09-28 (commits 9593e16c, 328a0f83), more than 2 years before the 2.13.1 release (2021-12-18). The blocklist entries are confirmed present in SubTypeValidator.java lines 124-127, preventing deserialization of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3, involving polymorphic typing issues with p6spy and commons-dbcp DataSource gadget classes. The target jackson-databind 2.13.1 is NOT affected because the upstream vendor fix (adding P6DataSource and commons-dbcp DataSource classes to the SubTypeValidator blocklist) was already included in the upstream 2.13.1 release. The fix was committed by Tatu Saloranta on 2019-09-28 (commits 9593e16c, 328a0f83), more than 2 years before the 2.13.1 release (2021-12-18). The blocklist entries are confirmed present in SubTypeValidator.java lines 124-127, preventing deserialization of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to unsafe polymorphic deserialization of net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.13.1 when TuxCare onboarded it. The fix (commit 191a4cdf87) adds the dangerous class to the SubTypeValidator blocklist, preventing its instantiation during polymorphic deserialization. This fix was authored by the upstream FasterXML maintainer Tatu Saloranta and shipped in the upstream 2.13.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to unsafe polymorphic deserialization of net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in version 2.13.1 when TuxCare onboarded it. The fix (commit 191a4cdf87) adds the dangerous class to the SubTypeValidator blocklist, preventing its instantiation during polymorphic deserialization. This fix was authored by the upstream FasterXML maintainer Tatu Saloranta and shipped in the upstream 2.13.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:50:46.310411+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 describes a polymorphic typing vulnerability in jackson-databind that allows remote code execution when Default Typing is enabled and apache-log4j-extra classes are in the classpath. The vulnerability is NOT PRESENT in jackson-databind 2.13.1-tuxcare.3 because the fix (blacklisting org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) was already included in upstream release 2.10.1 (October 2019), which predates the 2.13.1 release (December 2021) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 describes a polymorphic typing vulnerability in jackson-databind that allows remote code execution when Default Typing is enabled and apache-log4j-extra classes are in the classpath. The vulnerability is NOT PRESENT in jackson-databind 2.13.1-tuxcare.3 because the fix (blacklisting org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) was already included in upstream release 2.10.1 (October 2019), which predates the 2.13.1 release (December 2021) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT vulnerable to CVE-2019-20330. The fix was already included in the upstream 2.13.1 release that TuxCare onboarded. The two ehcache classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks are present in the deserialization blocklist at SubTypeValidator.java lines 133-135, and this blocklist is actively enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT vulnerable to CVE-2019-20330. The fix was already included in the upstream 2.13.1 release that TuxCare onboarded. The two ehcache classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks are present in the deserialization blocklist at SubTypeValidator.java lines 133-135, and this blocklist is actively enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:57.029053+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.1-tuxcare.3) is not affected by CVE-2020-10650. The vulnerability was fixed by upstream FasterXML in commit a424c038ba (March 2020), which added three JNDI gadget classes to the deserialization blocklist. This upstream fix was already present in the 2.13.1 release when TuxCare onboarded it (September 2026). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.1-tuxcare.3) is not affected by CVE-2020-10650. The vulnerability was fixed by upstream FasterXML in commit a424c038ba (March 2020), which added three JNDI gadget classes to the deserialization blocklist. This upstream fix was already present in the 2.13.1 release when TuxCare onboarded it (September 2026). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing RCE via Apache Aries JMS gadget classes (XaPooledConnectionFactory and RecoverablePooledConnectionFactory). The upstream fix, which adds these classes to the deserialization deny-list in SubTypeValidator.java, was already present in jackson-databind 2.13.1 when TuxCare onboarded it. The target code contains the complete defense at lines 163-164 of SubTypeValidator.java, blocking deserialization of both dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing RCE via Apache Aries JMS gadget classes (XaPooledConnectionFactory and RecoverablePooledConnectionFactory). The upstream fix, which adds these classes to the deserialization deny-list in SubTypeValidator.java, was already present in jackson-databind 2.13.1 when TuxCare onboarded it. The target code contains the complete defense at lines 163-164 of SubTypeValidator.java, blocking deserialization of both dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:32:27.596761+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, involving unsafe deserialization of com.caucho.config.types.ResourceRef gadget class. The target version 2.13.1-tuxcare.3 contains the upstream fix (blocklist entry) added by FasterXML maintainer Tatu Saloranta in commit 1645efbd39 on March 17, 2020. This fix was included in upstream release 2.13.1 before TuxCare onboarded it. The vulnerable pattern (unblocked deserialization of ResourceRef) is not present because the blocklist at SubTypeValidator.java:167 prevents instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, involving unsafe deserialization of com.caucho.config.types.ResourceRef gadget class. The target version 2.13.1-tuxcare.3 contains the upstream fix (blocklist entry) added by FasterXML maintainer Tatu Saloranta in commit 1645efbd39 on March 17, 2020. This fix was included in upstream release 2.13.1 before TuxCare onboarded it. The vulnerable pattern (unblocked deserialization of ResourceRef) is not present because the blocklist at SubTypeValidator.java:167 prevents instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 does not affect this target. The vulnerability involves Jackson databind's mishandling of polymorphic deserialization with the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix (adding this class to the deserialization denylist in SubTypeValidator.java) was implemented by upstream FasterXML in version 2.9.10.4 (commit 05d7e0e13f). This fix shipped in the upstream release 2.13.1, which TuxCare later onboarded. The target version 2.13.1-tuxcare.3 inherits this upstream fix, with the denylist entries present at lines 169-171 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 does not affect this target. The vulnerability involves Jackson databind's mishandling of polymorphic deserialization with the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix (adding this class to the deserialization denylist in SubTypeValidator.java) was implemented by upstream FasterXML in version 2.9.10.4 (commit 05d7e0e13f). This fix shipped in the upstream release 2.13.1, which TuxCare later onboarded. The target version 2.13.1-tuxcare.3 inherits this upstream fix, with the denylist entries present at lines 169-171 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT vulnerable to CVE-2020-10969. The vulnerability affects versions before 2.9.10.4, and the target version 2.13.1 includes the upstream fix that blocks deserialization of javax.swing.JEditorPane. The fix was authored by the upstream maintainer (Tatu Saloranta) and shipped in the upstream release before TuxCare onboarded version 2.13.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.1-tuxcare.3) is NOT vulnerable to CVE-2020-10969. The vulnerability affects versions before 2.9.10.4, and the target version 2.13.1 includes the upstream fix that blocks deserialization of javax.swing.JEditorPane. The fix was authored by the upstream maintainer (Tatu Saloranta) and shipped in the upstream release before TuxCare onboarded version 2.13.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.1-tuxcare.3 is not affected by CVE-2020-11111. The vulnerability's fix (blocking Apache ActiveMQ gadget classes from polymorphic deserialization) was already present in the upstream 2.13.1 release before TuxCare onboarded it. The SubTypeValidator.java file contains all nine ActiveMQ classes in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 173-184), which prevents their deserialization during JSON processing. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c14c9f99ed and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target jackson-databind 2.13.1-tuxcare.3 is not affected by CVE-2020-11111. The vulnerability's fix (blocking Apache ActiveMQ gadget classes from polymorphic deserialization) was already present in the upstream 2.13.1 release before TuxCare onboarded it. The SubTypeValidator.java file contains all nine ActiveMQ classes in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 173-184), which prevents their deserialization during JSON processing. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c14c9f99ed and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in jackson-databind 2.13.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 05d7e0e13f (March 2020) by adding org.apache.commons.proxy.provider.remoting.RmiProvider to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.13.1 release that TuxCare onboarded. The dangerous RmiProvider gadget class is blocked at line 186 of SubTypeValidator.java, preventing the serialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is not present in jackson-databind 2.13.1-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in commit 05d7e0e13f (March 2020) by adding org.apache.commons.proxy.provider.remoting.RmiProvider to the deserialization blacklist in SubTypeValidator.java. This fix was already included in the upstream 2.13.1 release that TuxCare onboarded. The dangerous RmiProvider gadget class is blocked at line 186 of SubTypeValidator.java, preventing the serialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind version 2.13.1-tuxcare.3. The vulnerability was fixed in upstream version 2.9.10.4 by adding \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.13.1 when TuxCare onboarded it, as confirmed by commit e2ba12d5d6 (authored by upstream maintainer Tatu Saloranta) being an ancestor of the onboarding commit. The blocklist entry is present at line 84 of SubTypeValidator.java and is actively enforced via BeanDeserializerFactory's call to validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is not present in jackson-databind version 2.13.1-tuxcare.3. The vulnerability was fixed in upstream version 2.9.10.4 by adding \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.13.1 when TuxCare onboarded it, as confirmed by commit e2ba12d5d6 (authored by upstream maintainer Tatu Saloranta) being an ancestor of the onboarding commit. The blocklist entry is present at line 84 of SubTypeValidator.java and is actively enforced via BeanDeserializerFactory's call to validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The vulnerability was fixed in upstream version 2.9.10.4 (released April 2020) and the fix is present in version 2.13.1. The fix commit 113e89fb08 added blacklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to SubTypeValidator.java, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.13.1 release that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The vulnerability was fixed in upstream version 2.9.10.4 (released April 2020) and the fix is present in version 2.13.1. The fix commit 113e89fb08 added blacklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to SubTypeValidator.java, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.13.1 release that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.13.1-tuxcare.3) is not affected by CVE-2020-11620. The vulnerability concerns unsafe deserialization of the org.apache.commons.jelly.impl.Embedded class. The vendor fix adds this class to a blocklist in SubTypeValidator.java. This fix is present in the target at line 189, but it was already included in the upstream jackson-databind 2.13.1 release that TuxCare onboarded. The fix commit (77040d85e) by Tatu Saloranta is an ancestor of the first TuxCare commit (254a19735). CVE-2020-11620 affects versions before 2.9.10.4; version 2.13.1 is much newer and ships with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target repository (jackson-databind version 2.13.1-tuxcare.3) is not affected by CVE-2020-11620. The vulnerability concerns unsafe deserialization of the org.apache.commons.jelly.impl.Embedded class. The vendor fix adds this class to a blocklist in SubTypeValidator.java. This fix is present in the target at line 189, but it was already included in the upstream jackson-databind 2.13.1 release that TuxCare onboarded. The fix commit (77040d85e) by Tatu Saloranta is an ancestor of the first TuxCare commit (254a19735). CVE-2020-11620 affects versions before 2.9.10.4; version 2.13.1 is much newer and ships with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-14060. The vulnerability pattern (ability to deserialize the dangerous gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) has been removed by an upstream vendor fix that was already present in the upstream 2.13.1 release. The dangerous class name is blacklisted in SubTypeValidator.java line 192, preventing polymorphic deserialization attacks via this gadget. The fix was authored by upstream maintainer Tatu Saloranta and integrated into jackson-databind starting with version 2.9.10.5 (June 2020), well before the 2.13.1 release (December 2021).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "The target version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-14060. The vulnerability pattern (ability to deserialize the dangerous gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) has been removed by an upstream vendor fix that was already present in the upstream 2.13.1 release. The dangerous class name is blacklisted in SubTypeValidator.java line 192, preventing polymorphic deserialization attacks via this gadget. The fix was authored by upstream maintainer Tatu Saloranta and integrated into jackson-databind starting with version 2.9.10.5 (June 2020), well before the 2.13.1 release (December 2021).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability affects versions before 2.9.10.5, but the target is version 2.13.1 which already contains the upstream fix. All five oracle.jms.AQjms* gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the deserialization blacklist at SubTypeValidator.java:200-204. The fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.13.1 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize these gadget classes for RCE) is not present because SubTypeValidator blocks them with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "Target jackson-databind 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability affects versions before 2.9.10.5, but the target is version 2.13.1 which already contains the upstream fix. All five oracle.jms.AQjms* gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the deserialization blacklist at SubTypeValidator.java:200-204. The fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.13.1 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize these gadget classes for RCE) is not present because SubTypeValidator blocks them with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.1-tuxcare.3 is not affected by CVE-2020-14062. The upstream vendor (FasterXML) included the fix in release 2.13.1, which TuxCare onboarded. The dangerous class \"com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool\" is blocked in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES at line 119, preventing JNDI injection attacks via polymorphic deserialization. The defense is mandatory and enforced through validateSubType() called from BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "Target version 2.13.1-tuxcare.3 is not affected by CVE-2020-14062. The upstream vendor (FasterXML) included the fix in release 2.13.1, which TuxCare onboarded. The dangerous class \"com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool\" is blocked in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES at line 119, preventing JNDI injection attacks via polymorphic deserialization. The defense is mandatory and enforced through validateSubType() called from BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.1-tuxcare.3) is not affected by CVE-2020-14195. The vulnerability was fixed in upstream release 2.13.1 before TuxCare onboarded this version. The fix adds \"org.jsecurity.realm.jndi.JndiRealmFactory\" to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 207), preventing deserialization of this JNDI-injection gadget class. The defense is active by default and blocks any attempt to deserialize this dangerous class through Jackson's polymorphic typing mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.1-tuxcare.3) is not affected by CVE-2020-14195. The vulnerability was fixed in upstream release 2.13.1 before TuxCare onboarded this version. The fix adds \"org.jsecurity.realm.jndi.JndiRealmFactory\" to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 207), preventing deserialization of this JNDI-injection gadget class. The defense is active by default and blocks any attempt to deserialize this dangerous class through Jackson's polymorphic typing mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:15.181090+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability relates to missing blocklist entry for br.com.anteros.dbcp.AnterosDBCPDataSource in polymorphic deserialization. The upstream fix (commit 3d97153944f by Tatu Saloranta on 2020-08-10) added this class to SubTypeValidator's blocklist, preventing malicious JSON with this gadget type from being deserialized. This fix was already present in upstream jackson-databind 2.13.1, which TuxCare onboarded. The target version inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability relates to missing blocklist entry for br.com.anteros.dbcp.AnterosDBCPDataSource in polymorphic deserialization. The upstream fix (commit 3d97153944f by Tatu Saloranta on 2020-08-10) added this class to SubTypeValidator's blocklist, preventing malicious JSON with this gadget type from being deserialized. This fix was already present in upstream jackson-databind 2.13.1, which TuxCare onboarded. The target version inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:17:20.138118+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerable deserialization gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is blocked via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 6cc9f1a1af) and was already present in the upstream 2.13.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerable deserialization gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is blocked via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 6cc9f1a1af) and was already present in the upstream 2.13.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.13.1-tuxcare.3. The fix was already included in the upstream Jackson 2.13.1 release that TuxCare onboarded. The fix (commit 612f971b78 by Tatu Saloranta) adds two critical XML parser features: (1) disallow-doctype-decl=true to block DOCTYPE declarations, and (2) load-external-dtd=false to prevent external DTD loading. These defenses completely eliminate XXE attack vectors by preventing XML entity expansion from accessing external resources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.13.1-tuxcare.3. The fix was already included in the upstream Jackson 2.13.1 release that TuxCare onboarded. The fix (commit 612f971b78 by Tatu Saloranta) adds two critical XML parser features: (1) disallow-doctype-decl=true to block DOCTYPE declarations, and (2) load-external-dtd=false to prevent external DTD loading. These defenses completely eliminate XXE attack vectors by preventing XML entity expansion from accessing external resources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:45.297248+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.1-tuxcare.3 is not affected by CVE-2020-35490. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, 2020-12-15) that blacklists org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream 2.13.1 release before TuxCare's onboarding. The dangerous classes are blocked at lines 217-218 of SubTypeValidator.java, preventing deserialization gadget exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "Target version 2.13.1-tuxcare.3 is not affected by CVE-2020-35490. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, 2020-12-15) that blacklists org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream 2.13.1 release before TuxCare's onboarding. The dangerous classes are blocked at lines 217-218 of SubTypeValidator.java, preventing deserialization gadget exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:48:57.330318+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.1 is not affected by CVE-2020-35491. The vulnerability involves deserialization of malicious gadget classes (org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable arbitrary code execution. The fix was included in upstream version 2.9.10.8 (commit 41b8bdb5cc by tatu.saloranta@iki.fi), and the target version 2.13.1 already contained this fix as part of the upstream release when TuxCare onboarded it. The blocklist entries are present in SubTypeValidator.java at lines 217-218.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "The target jackson-databind version 2.13.1 is not affected by CVE-2020-35491. The vulnerability involves deserialization of malicious gadget classes (org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable arbitrary code execution. The fix was included in upstream version 2.9.10.8 (commit 41b8bdb5cc by tatu.saloranta@iki.fi), and the target version 2.13.1 already contained this fix as part of the upstream release when TuxCare onboarded it. The blocklist entries are present in SubTypeValidator.java at lines 217-218.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:55:19.903675+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.1) is not affected by CVE-2020-35728. The vulnerability was fixed in upstream Jackson 2.9.10.8 (December 2020) by adding the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.13.1 release that TuxCare onboarded. The defense code exists at SubTypeValidator.java:240 and is actively enforced during deserialization via BeanDeserializerFactory:999.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.1) is not affected by CVE-2020-35728. The vulnerability was fixed in upstream Jackson 2.9.10.8 (December 2020) by adding the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.13.1 release that TuxCare onboarded. The defense code exists at SubTypeValidator.java:240 and is actively enforced during deserialization via BeanDeserializerFactory:999.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36179. The vulnerability involves missing blocklist entries for deserialization gadget classes (specifically oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS and related variants). The fix was included in upstream jackson-databind 2.13.1 (released January 2021) before TuxCare onboarded this version. All required blocklist entries from the security patch are present in SubTypeValidator.java lines 123, 193, 219, 228, and 234. The fix commit (3ded28aece6) by upstream maintainer Tatu Saloranta shipped in the upstream release, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "The target jackson-databind version 2.13.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36179. The vulnerability involves missing blocklist entries for deserialization gadget classes (specifically oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS and related variants). The fix was included in upstream jackson-databind 2.13.1 (released January 2021) before TuxCare onboarded this version. All required blocklist entries from the security patch are present in SubTypeValidator.java lines 123, 193, 219, 228, and 234. The fix commit (3ded28aece6) by upstream maintainer Tatu Saloranta shipped in the upstream release, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:17.536969+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.1 is not affected by CVE-2020-36180. The fix blocking DriverAdapterCPDS deserialization gadgets was already present in the upstream jackson-databind 2.13.1 release before TuxCare onboarded it. All five DriverAdapterCPDS blocklist entries from the patch (org.apache.commons.dbcp, dbcp2, tomcat variants, and oadd prefix) are present in SubTypeValidator.java. The fix commit 3ded28aece was authored by upstream maintainer Tatu Saloranta on 2020-12-31 and is an ancestor of TuxCare's onboarding commit from 2026-09-20, confirming this was an upstream fix shipped with the original 2.13.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "Target version 2.13.1 is not affected by CVE-2020-36180. The fix blocking DriverAdapterCPDS deserialization gadgets was already present in the upstream jackson-databind 2.13.1 release before TuxCare onboarded it. All five DriverAdapterCPDS blocklist entries from the patch (org.apache.commons.dbcp, dbcp2, tomcat variants, and oadd prefix) are present in SubTypeValidator.java. The fix commit 3ded28aece was authored by upstream maintainer Tatu Saloranta on 2020-12-31 and is an ancestor of TuxCare's onboarding commit from 2026-09-20, confirming this was an upstream fix shipped with the original 2.13.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:30.480251+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability affects jackson-databind versions before 2.9.10.8, related to deserialization gadgets using org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.1 already contains the upstream fix (commit 3ded28aece from issue #3004) that blocks deserialization of these gadget classes by adding them to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was present in the upstream 2.13.1 release before TuxCare onboarded it, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.13.1-tuxcare.3. The vulnerability affects jackson-databind versions before 2.9.10.8, related to deserialization gadgets using org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.13.1 already contains the upstream fix (commit 3ded28aece from issue #3004) that blocks deserialization of these gadget classes by adding them to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was present in the upstream 2.13.1 release before TuxCare onboarded it, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:13:47.994162+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions before 2.9.10.8. The target version 2.13.1-tuxcare.3 is significantly newer and contains the upstream fix that was shipped in jackson-databind 2.13.1. The fix (commit 3ded28aece) adds DriverAdapterCPDS class variants to the deserialization blocklist in SubTypeValidator.java. All required blocklist entries are present in the target code at lines 123, 193, 219, 228, and 234. This is an upstream fix authored by Tatu Saloranta that was already included in the 2.13.1 release before TuxCare onboarded it (onboarding commit 254a197350 by amoniatovskiy@cloudlinux.com). The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 affects jackson-databind versions before 2.9.10.8. The target version 2.13.1-tuxcare.3 is significantly newer and contains the upstream fix that was shipped in jackson-databind 2.13.1. The fix (commit 3ded28aece) adds DriverAdapterCPDS class variants to the deserialization blocklist in SubTypeValidator.java. All required blocklist entries are present in the target code at lines 123, 193, 219, 228, and 234. This is an upstream fix authored by Tatu Saloranta that was already included in the 2.13.1 release before TuxCare onboarded it (onboarding commit 254a197350 by amoniatovskiy@cloudlinux.com). The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:21:42.964789+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.13.1-tuxcare.3. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was already included in the upstream 2.13.1 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked by SubTypeValidator at line 243, preventing arbitrary code execution through polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.13.1-tuxcare.3. The fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) was already included in the upstream 2.13.1 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked by SubTypeValidator at line 243, preventing arbitrary code execution through polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource, enabling deserialization gadget chain exploitation. The target version 2.13.1-tuxcare.3 already contains the upstream fix (commit 567194c53a by Tatu Saloranta) which was shipped in upstream release 2.9.10.8. The fix adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 235-236), preventing their deserialization. This fix was present in the upstream release before TuxCare onboarded version 2.13.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource, enabling deserialization gadget chain exploitation. The target version 2.13.1-tuxcare.3 already contains the upstream fix (commit 567194c53a by Tatu Saloranta) which was shipped in upstream release 2.9.10.8. The fix adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 235-236), preventing their deserialization. This fix was present in the upstream release before TuxCare onboarded version 2.13.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:07:58.117916+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target version 2.13.1-tuxcare.3 is NOT AFFECTED because these blocklist entries are already present in SubTypeValidator.java (lines 235-236). The fix was contributed by upstream maintainer Tatu Saloranta in commit 567194c53ae (Dec 26, 2020) and was included in the upstream 2.13.1 release before TuxCare onboarded it. The defense mechanism is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target version 2.13.1-tuxcare.3 is NOT AFFECTED because these blocklist entries are already present in SubTypeValidator.java (lines 235-236). The fix was contributed by upstream maintainer Tatu Saloranta in commit 567194c53ae (Dec 26, 2020) and was included in the upstream 2.13.1 release before TuxCare onboarded it. The defense mechanism is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:04.109725+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.1-tuxcare.3 is not affected by CVE-2020-36186. The upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource was committed on 2020-12-26 (commit 3e8fa3beea) and was already included in the upstream 2.13.1 release (2021-12-18) that TuxCare onboarded. The gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:229-230, preventing exploitation of this deserialization vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target jackson-databind 2.13.1-tuxcare.3 is not affected by CVE-2020-36186. The upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource was committed on 2020-12-26 (commit 3e8fa3beea) and was already included in the upstream 2.13.1 release (2021-12-18) that TuxCare onboarded. The gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:229-230, preventing exploitation of this deserialization vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:48:05.007690+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.13.1. The fix was already included in the upstream FasterXML 2.13.1 release (commit 3e8fa3beea by Tatu Saloranta, Dec 26 2020) before TuxCare onboarded this version. The dangerous classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource are blacklisted in SubTypeValidator.java lines 229-230, preventing their deserialization. The blacklist is enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory line 140 during polymorphic type deserialization, blocking the attack before any dangerous object instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.13.1. The fix was already included in the upstream FasterXML 2.13.1 release (commit 3e8fa3beea by Tatu Saloranta, Dec 26 2020) before TuxCare onboarded this version. The dangerous classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource are blacklisted in SubTypeValidator.java lines 229-230, preventing their deserialization. The blacklist is enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory line 140 during polymorphic type deserialization, blocking the attack before any dangerous object instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:53:46.035464+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability concerns deserialization gadgets (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable JNDI injection attacks. The upstream fix (commit 33d96c13fe by tatu.saloranta@iki.fi) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already present in upstream jackson-databind 2.13.1 before TuxCare's onboarding, confirmed by the fix commit being an ancestor of TuxCare's first commit (254a197350 \"Onboard version 2.13.1\"). The blocklist is actively enforced during polymorphic deserialization via SubTypeValidator.validateSubType() called from BeanDeserializerFactory, which throws JsonMappingException when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability concerns deserialization gadgets (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable JNDI injection attacks. The upstream fix (commit 33d96c13fe by tatu.saloranta@iki.fi) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already present in upstream jackson-databind 2.13.1 before TuxCare's onboarding, confirmed by the fix commit being an ancestor of TuxCare's first commit (254a197350 \"Onboard version 2.13.1\"). The blocklist is actively enforced during polymorphic deserialization via SubTypeValidator.validateSubType() called from BeanDeserializerFactory, which throws JsonMappingException when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:00.441936+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.1-tuxcare.3) is not affected by CVE-2020-36189. The vulnerability involves Jackson deserialization gadgets (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) that could establish attacker-controlled database/JNDI connections, enabling remote code execution. The fix was already present in the upstream jackson-databind 2.13.1 release, added by upstream maintainer Tatu Saloranta in commit 33d96c13fe on December 26, 2020, before TuxCare onboarded this version. The dangerous classes are blacklisted in SubTypeValidator.java (lines 223-224), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.1-tuxcare.3) is not affected by CVE-2020-36189. The vulnerability involves Jackson deserialization gadgets (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) that could establish attacker-controlled database/JNDI connections, enabling remote code execution. The fix was already present in the upstream jackson-databind 2.13.1 release, added by upstream maintainer Tatu Saloranta in commit 33d96c13fe on December 26, 2020, before TuxCare onboarded this version. The dangerous classes are blacklisted in SubTypeValidator.java (lines 223-224), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability concerns missing blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, which could enable JNDI-based remote code execution via polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 914e7c9f2c by adding JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.13.1 release before TuxCare onboarded the version, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability concerns missing blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, which could enable JNDI-based remote code execution via polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 914e7c9f2c by adding JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.13.1 release before TuxCare onboarded the version, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability involves deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig as a gadget class. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) added this class to the SubTypeValidator blocklist at line 141, preventing its deserialization. This fix was already present in the upstream Jackson 2.13.1 release when TuxCare onboarded it (commit 254a19735), making it an upstream fix rather than a TuxCare backport. The defense is integrated into the critical deserialization path at BeanDeserializerFactory.java:140 and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.13.1-tuxcare.3. The vulnerability involves deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig as a gadget class. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) added this class to the SubTypeValidator blocklist at line 141, preventing its deserialization. This fix was already present in the upstream Jackson 2.13.1 release when TuxCare onboarded it (commit 254a19735), making it an upstream fix rather than a TuxCare backport. The defense is integrated into the critical deserialization path at BeanDeserializerFactory.java:140 and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entry for the deserialization gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target version 2.13.1-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream release 2.13.1 before TuxCare onboarded it. The blocklist entry exists at line 144 of SubTypeValidator.java, preventing deserialization of this dangerous gadget class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1e64db6a2f on Feb 29, 2020, as part of fixing jackson-databind issues #2631 and #2634.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entry for the deserialization gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target version 2.13.1-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream release 2.13.1 before TuxCare onboarded it. The blocklist entry exists at line 144 of SubTypeValidator.java, preventing deserialization of this dangerous gadget class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1e64db6a2f on Feb 29, 2020, as part of fixing jackson-databind issues #2631 and #2634.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:18:43.675482+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.13.1-tuxcare.3. The fix for this vulnerability was already included in upstream jackson-databind 2.13.1 when TuxCare onboarded the version. The vulnerable pattern (ability to deserialize the gadget class br.com.anteros.dbcp.AnterosDBCPConfig) is blocked by a blocklist entry in SubTypeValidator.java that prevents deserialization of this class, thereby breaking the attack chain from polymorphic type identifiers to arbitrary code execution via deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.13.1-tuxcare.3. The fix for this vulnerability was already included in upstream jackson-databind 2.13.1 when TuxCare onboarded the version. The vulnerable pattern (ability to deserialize the gadget class br.com.anteros.dbcp.AnterosDBCPConfig) is blocked by a blocklist entry in SubTypeValidator.java that prevents deserialization of this class, thereby breaking the attack chain from polymorphic type identifiers to arbitrary code execution via deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:16:30.596459+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.13.1-tuxcare.3. The fix (blocking javax.swing.JTextPane from polymorphic deserialization) was already included in the upstream 2.13.1 release. The vulnerable code pattern does not exist in this version - the SubTypeValidator blocklist at lines 149-151 contains the required entry that prevents exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.13.1-tuxcare.3. The fix (blocking javax.swing.JTextPane from polymorphic deserialization) was already included in the upstream 2.13.1 release. The vulnerable code pattern does not exist in this version - the SubTypeValidator blocklist at lines 149-151 contains the required entry that prevents exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind 2.13.x before 2.13.1. The target version is 2.13.1-tuxcare.3, which contains the upstream fix (commit 3ccde7d938) that shipped with the upstream 2.13.1 release. The fix limits eager allocation in NodeSerialization.readExternal() to 100KB and uses incremental reading for larger sizes, preventing the DoS attack via excessive heap allocation. The vulnerable code pattern (direct array allocation based on attacker-controlled length) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 affects jackson-databind 2.13.x before 2.13.1. The target version is 2.13.1-tuxcare.3, which contains the upstream fix (commit 3ccde7d938) that shipped with the upstream 2.13.1 release. The fix limits eager allocation in NodeSerialization.readExternal() to 100KB and uses incremental reading for larger sizes, preventing the DoS attack via excessive heap allocation. The vulnerable code pattern (direct array allocation based on attacker-controlled length) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:40:00.520694+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.1 is not affected by CVE-2026-54517. The vulnerability requires setterless Collection/Map properties to traverse the unguarded buffering path in BeanDeserializer._deserializeUsingPropertyBased, but the code change that routes setterless properties through this path (SetterlessProperty.isMerging() returning true) was introduced in version 2.21.0, after 2.13.1. While the underlying f...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.13.1 is not affected by CVE-2026-54517. The vulnerability requires setterless Collection/Map properties to traverse the unguarded buffering path in BeanDeserializer._deserializeUsingPropertyBased, but the code change that routes setterless properties through this path (SetterlessProperty.isMerging() returning true) was introduced in version 2.21.0, after 2.13.1. While the underlying f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:21:41.442666+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "action_statement": "Vulnerability CVE-2026-54518 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:21:41.442666+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.1-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:14:56.846731+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.1-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}