{
  "@id": "urn:uuid:0a3d8c25-915b-4387-b1cd-28f2765a6c90",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 87,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:09:22.293853+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:03:12.649222+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5-tuxcare.2 is not affected by CVE-2017-15095. The CVE affects jackson-databind versions prior to 2.8.11 and 2.9.4, requiring blacklisting of additional dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and Spring/C3P0 classes) to prevent polymorphic deserialization attacks. The target version 2.13.5 already contains SubTypeValidator with comprehensive blacklists including all CVE-2017-15095 classes plus 100+ additional dangerous classes from later security fixes. This fix was present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded, not added by TuxCare backporting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "Target version 2.13.5-tuxcare.2 is not affected by CVE-2017-15095. The CVE affects jackson-databind versions prior to 2.8.11 and 2.9.4, requiring blacklisting of additional dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and Spring/C3P0 classes) to prevent polymorphic deserialization attacks. The target version 2.13.5 already contains SubTypeValidator with comprehensive blacklists including all CVE-2017-15095 classes plus 100+ additional dangerous classes from later security fixes. This fix was present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded, not added by TuxCare backporting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:38:44.459266+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 targets jackson-databind versions \"through 2.8.10 and 2.9.x through 2.9.3\" for an incomplete deserialization blacklist that could be bypassed using Spring framework gadgets. The target repository is jackson-databind 2.13.5-tuxcare.3, which is far beyond the affected version range. The upstream vendor (FasterXML) fixed this CVE in versions 2.7.9.2, 2.8.11, and 2.9.4 (December 2017) by adding dangerous classes to SubTypeValidator's blacklist and implementing pattern-based checks for Spring framework types. All fix commits (e865a7a446, 2235894210, bb45fb1670) were already present in the upstream 2.13.5 release that TuxCare onboarded (first TuxCare commit b608fb38d7). The target contains the complete defense: SubTypeValidator with all blacklisted classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and C3P0 types) plus Spring framework superclass pattern matching (AbstractPointcutAdvisor, AbstractApplicationContext). Additionally, version 2.13.x has a sophisticated PolymorphicTypeValidator system that provides defense-in-depth beyond the basic blacklist approach used in affected versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 targets jackson-databind versions \"through 2.8.10 and 2.9.x through 2.9.3\" for an incomplete deserialization blacklist that could be bypassed using Spring framework gadgets. The target repository is jackson-databind 2.13.5-tuxcare.3, which is far beyond the affected version range. The upstream vendor (FasterXML) fixed this CVE in versions 2.7.9.2, 2.8.11, and 2.9.4 (December 2017) by adding dangerous classes to SubTypeValidator's blacklist and implementing pattern-based checks for Spring framework types. All fix commits (e865a7a446, 2235894210, bb45fb1670) were already present in the upstream 2.13.5 release that TuxCare onboarded (first TuxCare commit b608fb38d7). The target contains the complete defense: SubTypeValidator with all blacklisted classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and C3P0 types) plus Spring framework superclass pattern matching (AbstractPointcutAdvisor, AbstractApplicationContext). Additionally, version 2.13.x has a sophisticated PolymorphicTypeValidator system that provides defense-in-depth beyond the basic blacklist approach used in affected versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:24:07.299123+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2017-7525. The vulnerability (unsafe deserialization of dangerous classes like TemplatesImpl) was fixed in the upstream release and is not present in this version. The fix evolved from the original checkIllegalTypes() method into the SubTypeValidator.validateSubType() system, which maintains a comprehensive blacklist of dangerous classes and is called during bean deserialization at BeanDeserializerFactory.java:140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2017-7525. The vulnerability (unsafe deserialization of dangerous classes like TemplatesImpl) was fixed in the upstream release and is not present in this version. The fix evolved from the original checkIllegalTypes() method into the SubTypeValidator.validateSubType() system, which maintains a comprehensive blacklist of dangerous classes and is called during bean deserialization at BeanDeserializerFactory.java:140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involved deserialization of the iBatis XPathParser gadget class when default typing is enabled, allowing data exfiltration. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 (June 2018) by adding \"org.apache.ibatis.parsing.XPathParser\" to the deserialization blacklist in SubTypeValidator.java. The target version 2.13.5 (released November 2022) already contains this upstream fix at lines 64-65 of SubTypeValidator.java. The fix was present in the upstream release that TuxCare onboarded (commit b608fb38d7), making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involved deserialization of the iBatis XPathParser gadget class when default typing is enabled, allowing data exfiltration. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 (June 2018) by adding \"org.apache.ibatis.parsing.XPathParser\" to the deserialization blacklist in SubTypeValidator.java. The target version 2.13.5 (released November 2022) already contains this upstream fix at lines 64-65 of SubTypeValidator.java. The fix was present in the upstream release that TuxCare onboarded (commit b608fb38d7), making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:13:44.782673+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing RCE via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The target (jackson-databind 2.13.5-tuxcare.3) is not affected because the upstream fix was already present in the 2.13.5 release. The fix adds \"jodd.db.connection.DataSourceConnectionProvider\" to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 68), preventing deserialization of this gadget class. This fix was introduced by upstream maintainer Tatu Saloranta in commit 7487cf7eb1 and shipped with the upstream 2.13.5 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing RCE via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The target (jackson-databind 2.13.5-tuxcare.3) is not affected because the upstream fix was already present in the 2.13.5 release. The fix adds \"jodd.db.connection.DataSourceConnectionProvider\" to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 68), preventing deserialization of this gadget class. This fix was introduced by upstream maintainer Tatu Saloranta in commit 7487cf7eb1 and shipped with the upstream 2.13.5 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability enables arbitrary code execution via polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing attackers to trigger JNDI/LDAP lookups to malicious servers. The upstream fix added these classes to the deserialization blocklist in SubTypeValidator.java (lines 70-72), preventing their instantiation. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 7487cf7eb1 and shipped in the upstream jackson-databind 2.13.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability enables arbitrary code execution via polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing attackers to trigger JNDI/LDAP lookups to malicious servers. The upstream fix added these classes to the deserialization blocklist in SubTypeValidator.java (lines 70-72), preventing their instantiation. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 7487cf7eb1 and shipped in the upstream jackson-databind 2.13.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:37:41.470053+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT PRESENT in jackson-databind 2.13.5-tuxcare.3. The vulnerability allowed arbitrary code execution via polymorphic deserialization of the slf4j-ext EventData class. The fix (commit 87d29af25e) added \"org.slf4j.ext.EventData\" and three other gadget classes to a blocklist in SubTypeValidator.java (lines 74-78). This fix was authored by upstream maintainer Tatu Saloranta on 2018-08-16 and was already present in upstream release 2.13.5 when TuxCare onboarded it (commit b608fb38d7c2). The blocklist is actively enforced on every polymorphic deserialization path via BeanDeserializerFactory\u2192_validateSubType()\u2192SubTypeValidator.validateSubType(), which throws an error for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT PRESENT in jackson-databind 2.13.5-tuxcare.3. The vulnerability allowed arbitrary code execution via polymorphic deserialization of the slf4j-ext EventData class. The fix (commit 87d29af25e) added \"org.slf4j.ext.EventData\" and three other gadget classes to a blocklist in SubTypeValidator.java (lines 74-78). This fix was authored by upstream maintainer Tatu Saloranta on 2018-08-16 and was already present in upstream release 2.13.5 when TuxCare onboarded it (commit b608fb38d7c2). The blocklist is actively enforced on every polymorphic deserialization path via BeanDeserializerFactory\u2192_validateSubType()\u2192SubTypeValidator.validateSubType(), which throws an error for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:54:42.566702+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind version 2.13.5-tuxcare.3 is not affected by CVE-2018-14719. The fix blocking blaze-ds gadget classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and others) from polymorphic deserialization was already present in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable code pattern is not present because the upstream vendor (Tatu Saloranta) fixed it in August 2018, and this fix was included in all subsequent releases including 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "Target repository jackson-databind version 2.13.5-tuxcare.3 is not affected by CVE-2018-14719. The fix blocking blaze-ds gadget classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and others) from polymorphic deserialization was already present in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable code pattern is not present because the upstream vendor (Tatu Saloranta) fixed it in August 2018, and this fix was included in all subsequent releases including 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:12.850766+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involved allowing polymorphic deserialization of four dangerous JDK/3rd-party classes that could lead to XXE attacks and other exploits. The fix (blacklisting org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream 2.13.5 release. These classes are blacklisted in SubTypeValidator.java:74-78, preventing their deserialization. The upstream fix commit (87d29af25e82a249ea15858e2d4ecbf64091db44) by Tatu Saloranta predates TuxCare's onboarding of version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involved allowing polymorphic deserialization of four dangerous JDK/3rd-party classes that could lead to XXE attacks and other exploits. The fix (blacklisting org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream 2.13.5 release. These classes are blacklisted in SubTypeValidator.java:74-78, preventing their deserialization. The upstream fix commit (87d29af25e82a249ea15858e2d4ecbf64091db44) by Tatu Saloranta predates TuxCare's onboarding of version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:30:42.582195+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blacklist entries for dangerous classes including org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target version 2.13.5-tuxcare.3 is NOT affected because the upstream vendor fix (commit 87d29af25e) was already included in the upstream release 2.13.5 that TuxCare onboarded. The fix adds the axis2-jaxws class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist, preventing polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blacklist entries for dangerous classes including org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target version 2.13.5-tuxcare.3 is NOT affected because the upstream vendor fix (commit 87d29af25e) was already included in the upstream release 2.13.5 that TuxCare onboarded. The fix adds the axis2-jaxws class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist, preventing polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.13.5-tuxcare.2. The vulnerability concerns missing blocklist protection for org.apache.axis2.transport.jms.JMSOutTransportInfo during polymorphic deserialization. The target contains the upstream fix at SubTypeValidator.java:85, which was authored by FasterXML maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 and shipped in the upstream 2.13.5 release before TuxCare onboarding. The vulnerable pattern (missing blocklist entry) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.13.5-tuxcare.2. The vulnerability concerns missing blocklist protection for org.apache.axis2.transport.jms.JMSOutTransportInfo during polymorphic deserialization. The target contains the upstream fix at SubTypeValidator.java:85, which was authored by FasterXML maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 and shipped in the upstream 2.13.5 release before TuxCare onboarding. The vulnerable pattern (missing blocklist entry) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:52:51.215173+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 concerns polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that enable gadget chain exploitation. The vendor fix adds these classes to a blocklist in SubTypeValidator.java. The target repository (jackson-databind 2.13.5-tuxcare.3) already contains this fix, which shipped in upstream release 2.13.5 before TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 72cd4025a229fb28ec133235003dd4616f70afaa. The blocklist is enforced during bean deserialization via BeanDeserializerFactory._validateSubType(), preventing deserialization of the dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 concerns polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that enable gadget chain exploitation. The vendor fix adds these classes to a blocklist in SubTypeValidator.java. The target repository (jackson-databind 2.13.5-tuxcare.3) already contains this fix, which shipped in upstream release 2.13.5 before TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 72cd4025a229fb28ec133235003dd4616f70afaa. The blocklist is enforced during bean deserialization via BeanDeserializerFactory._validateSubType(), preventing deserialization of the dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:22:16.875749+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 addresses polymorphic deserialization of jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor). The target jackson-databind 2.13.5-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already present in the upstream release 2.13.5 before TuxCare onboarded it. The blocklist entry exists in SubTypeValidator.java line 81 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType() at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 addresses polymorphic deserialization of jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor). The target jackson-databind 2.13.5-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already present in the upstream release 2.13.5 before TuxCare onboarded it. The blocklist entry exists in SubTypeValidator.java line 81 and is actively enforced during deserialization via BeanDeserializerFactory._validateSubType() at line 140.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass previous blacklist fixes. The target version 2.13.5-tuxcare.3 is NOT vulnerable because the fix was already present in upstream release 2.13.5, which TuxCare onboarded. The SubTypeValidator.java file contains both blacklist entries at lines 62-63, added by upstream commit 038b471e2e on 2018-01-21 by maintainer Tatu Saloranta, years before the 2.13.5 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass previous blacklist fixes. The target version 2.13.5-tuxcare.3 is NOT vulnerable because the fix was already present in upstream release 2.13.5, which TuxCare onboarded. The SubTypeValidator.java file contains both blacklist entries at lines 62-63, added by upstream commit 038b471e2e on 2018-01-21 by maintainer Tatu Saloranta, years before the 2.13.5 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:59.098532+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.5-tuxcare.3 is NOT affected by CVE-2018-7489. The vulnerability (missing validation to block c3p0 DataSource classes from polymorphic deserialization) was fixed by upstream FasterXML in February 2018 (versions 2.7.9.3, 2.8.11.1, 2.9.5). The fix commit (6799f8f10c) by Tatu Saloranta is present in the target and was part of the upstream release 2.13.5 that TuxCare onboarded in May 2022. The defense code in SubTypeValidator.java (lines 24, 288-298) blocks any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\", preventing exploitation via ComboPooledDataSource and similar gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target jackson-databind 2.13.5-tuxcare.3 is NOT affected by CVE-2018-7489. The vulnerability (missing validation to block c3p0 DataSource classes from polymorphic deserialization) was fixed by upstream FasterXML in February 2018 (versions 2.7.9.3, 2.8.11.1, 2.9.5). The fix commit (6799f8f10c) by Tatu Saloranta is present in the target and was part of the upstream release 2.13.5 that TuxCare onboarded in May 2022. The defense code in SubTypeValidator.java (lines 24, 288-298) blocks any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\", preventing exploitation via ComboPooledDataSource and similar gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:27:37.057480+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.5-tuxcare.3 is NOT vulnerable to CVE-2019-12086. The fix (blocklist entry for \"com.mysql.cj.jdbc.admin.MiniAdmin\") was already present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. The vulnerability was fixed by upstream maintainer Tatu Saloranta in May 2019 (commit dda513bd) for version 2.9.9, and this fix is present in all subsequent versions including 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target jackson-databind 2.13.5-tuxcare.3 is NOT vulnerable to CVE-2019-12086. The fix (blocklist entry for \"com.mysql.cj.jdbc.admin.MiniAdmin\") was already present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. The vulnerability was fixed by upstream maintainer Tatu Saloranta in May 2019 (commit dda513bd) for version 2.9.9, and this fix is present in all subsequent versions including 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:21:31.954471+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability affects jackson-databind 2.x before 2.9.9.1 and involves polymorphic deserialization of the logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource`. The upstream vendor (FasterXML) fixed this in commit c9ef4a10d6 by adding the dangerous class to the deserialization blocklist in SubTypeValidat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability affects jackson-databind 2.x before 2.9.9.1 and involves polymorphic deserialization of the logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource`. The upstream vendor (FasterXML) fixed this in commit c9ef4a10d6 by adding the dangerous class to the deserialization blocklist in SubTypeValidat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:02:00.106952+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 does not affect this target. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The upstream jackson-databind 2.13.5 release already contained the fix (commit 5f7c69bba0) which blocks org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java. TuxCare onboarded this fixed version, s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 does not affect this target. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The upstream jackson-databind 2.13.5 release already contained the fix (commit 5f7c69bba0) which blocks org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java. TuxCare onboarded this fixed version, s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:00.062525+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5 is NOT affected by CVE-2019-14379. The upstream fix adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist was already present in the upstream release 2.13.5 that TuxCare onboarded. The fix commit ad418eeb97 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit (b608fb38d7c), confirming it shipped with the original upstream release. The vulnerable code pattern (missing blacklist entry) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "Target version 2.13.5 is NOT affected by CVE-2019-14379. The upstream fix adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist was already present in the upstream release 2.13.5 that TuxCare onboarded. The fix commit ad418eeb97 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit (b608fb38d7c), confirming it shipped with the original upstream release. The vulnerable code pattern (missing blacklist entry) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:27:48.785598+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves polymorphic deserialization allowing instantiation of ch.qos.logback.core.db.JNDIConnectionSource, which can lead to RCE via JNDI injection. The fix (blacklisting this class in SubTypeValidator) was added by upstream maintainer Tatu Saloranta in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b and was already included in upstream release 2.13.5 before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:102.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves polymorphic deserialization allowing instantiation of ch.qos.logback.core.db.JNDIConnectionSource, which can lead to RCE via JNDI injection. The fix (blacklisting this class in SubTypeValidator) was added by upstream maintainer Tatu Saloranta in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b and was already included in upstream release 2.13.5 before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:102.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:56.211039+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2019-14540. The vulnerability was fixed by upstream vendor FasterXML in August 2019 (commit d4983c740f), which added HikariConfig and HikariDataSource to the polymorphic deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.5 release when TuxCare onboarded it in September 2026. The blocklist entries at lines 104-107 prevent instantiation of these dangerous types during polymorphic deserialization, blocking the gadget chain exploitation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "Target repository jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2019-14540. The vulnerability was fixed by upstream vendor FasterXML in August 2019 (commit d4983c740f), which added HikariConfig and HikariDataSource to the polymorphic deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.5 release when TuxCare onboarded it in September 2026. The blocklist entries at lines 104-107 prevent instantiation of these dangerous types during polymorphic deserialization, blocking the gadget chain exploitation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:51:34.970346+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code. The fix (adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist) was already present in the upstream 2.13.5 release that TuxCare onboarded. The fix commit (41b7f9b90149e9d44a65a8261a8deedc7186f6af) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding. The target version 2.13.5 is well after the fixed versions (2.9.10, 2.8.11.5, 2.6.7.3) mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability allows polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code. The fix (adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist) was already present in the upstream 2.13.5 release that TuxCare onboarded. The fix commit (41b7f9b90149e9d44a65a8261a8deedc7186f6af) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding. The target version 2.13.5 is well after the fixed versions (2.9.10, 2.8.11.5, 2.6.7.3) mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5 is not affected by CVE-2019-14893. The vulnerability allows polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The upstream fix was committed on 2019-09-19 and included in jackson-databind 2.9.10 (released 2019-09-21). Target version 2.13.5 was onboarded by TuxCare with this fix already present in the upstream release. The SubTypeValidator blocklist containing the gadget class is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "Target version 2.13.5 is not affected by CVE-2019-14893. The vulnerability allows polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The upstream fix was committed on 2019-09-19 and included in jackson-databind 2.9.10 (released 2019-09-21). Target version 2.13.5 was onboarded by TuxCare with this fix already present in the upstream release. The SubTypeValidator blocklist containing the gadget class is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:00:04.359123+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.13.5. The fix that adds com.zaxxer.hikari.HikariDataSource to the polymorphic deserialization blocklist (commit 73c1c2cc76) was already present in the upstream release 2.13.5 when TuxCare onboarded it. The vulnerable pattern \u2014 allowing HikariDataSource as a polymorphic deserialization target \u2014 does not exist in this version. This is an upstream fix authored by Tatu Saloranta that shipped before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.13.5. The fix that adds com.zaxxer.hikari.HikariDataSource to the polymorphic deserialization blocklist (commit 73c1c2cc76) was already present in the upstream release 2.13.5 when TuxCare onboarded it. The vulnerable pattern \u2014 allowing HikariDataSource as a polymorphic deserialization target \u2014 does not exist in this version. This is an upstream fix authored by Tatu Saloranta that shipped before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:59:26.989221+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5-tuxcare.3 is not affected by CVE-2019-16942. The vulnerability affects jackson-databind 2.0.0-2.9.10, and the fix was already present in the upstream 2.13.5 release before TuxCare onboarding. The dangerous classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, com.p6spy.engine.spy.P6DataSource) are blacklisted in SubTypeValidator.java, preventing polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "Target version 2.13.5-tuxcare.3 is not affected by CVE-2019-16942. The vulnerability affects jackson-databind 2.0.0-2.9.10, and the fix was already present in the upstream 2.13.5 release before TuxCare onboarding. The dangerous classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, com.p6spy.engine.spy.P6DataSource) are blacklisted in SubTypeValidator.java, preventing polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:11:01.996232+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 due to unsafe deserialization of P6DataSource and commons-dbcp DataSource classes when Default Typing is enabled. The target (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fix is present: SubTypeValidator.java blocklists all three dangerous classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) at lines 124-127. This fix was authored by upstream vendor Tatu Saloranta (commit 9593e16cf5) and shipped with upstream release 2.13.5, which TuxCare later onboarded. The blocklist prevents polymorphic deserialization of these classes, blocking the attack chain before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 due to unsafe deserialization of P6DataSource and commons-dbcp DataSource classes when Default Typing is enabled. The target (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fix is present: SubTypeValidator.java blocklists all three dangerous classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource) at lines 124-127. This fix was authored by upstream vendor Tatu Saloranta (commit 9593e16cf5) and shipped with upstream release 2.13.5, which TuxCare later onboarded. The blocklist prevents polymorphic deserialization of these classes, blocking the attack chain before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:25:39.175944+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10/2.8.11.5 due to a missing blocklist entry for the gadget class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`, enabling arbitrary code execution via polymorphic deserialization. The target (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream fix was already included in Jackson 2.13.5 when TuxCare onboarded this version. The blocklist entry is present at SubTypeValidator.java:99 and actively enforced during deserialization, rejecting attempts to instantiate this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10/2.8.11.5 due to a missing blocklist entry for the gadget class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`, enabling arbitrary code execution via polymorphic deserialization. The target (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream fix was already included in Jackson 2.13.5 when TuxCare onboarded this version. The blocklist entry is present at SubTypeValidator.java:99 and actively enforced during deserialization, rejecting attempts to instantiate this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:43:50.613659+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind when polymorphic typing is enabled, allowing deserialization of dangerous apache-log4j-extras (1.2.x) classes that can trigger JNDI-based remote code execution. The target repository jackson-databind 2.13.5-tuxcare.3 is NOT AFFECTED because the upstream vendor fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) was already present in version 2.13.5 when TuxCare onboarded it. The fix adds two log4j receiver class names (DriverManagerConnectionSource and JNDIConnectionSource) to the deserialization blocklist in SubTypeValidator.java, preventing their instantiation. The defense is actively enforced: the validateSubType method checks incoming types against the blocklist and rejects deserialization with a security error. Since this is an upstream-authored fix that shipped in the original 2.13.5 release, the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind when polymorphic typing is enabled, allowing deserialization of dangerous apache-log4j-extras (1.2.x) classes that can trigger JNDI-based remote code execution. The target repository jackson-databind 2.13.5-tuxcare.3 is NOT AFFECTED because the upstream vendor fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) was already present in version 2.13.5 when TuxCare onboarded it. The fix adds two log4j receiver class names (DriverManagerConnectionSource and JNDIConnectionSource) to the deserialization blocklist in SubTypeValidator.java, preventing their instantiation. The defense is actively enforced: the validateSubType method checks incoming types against the blocklist and rejects deserialization with a security error. Since this is an upstream-authored fix that shipped in the original 2.13.5 release, the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions before 2.9.10.2 due to missing blacklist entries for two ehcache JNDI selector classes that enable JNDI injection attacks. The target repository is jackson-databind 2.13.5-tuxcare.3, which already contains the upstream fix. The two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) are present in the deserialization blacklist at SubTypeValidator.java lines 134-135. This fix was introduced by upstream vendor Tatu Saloranta in commit eb254813cc822d0af015ce8fe05febf50721dc53 and was already present in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 affects jackson-databind versions before 2.9.10.2 due to missing blacklist entries for two ehcache JNDI selector classes that enable JNDI injection attacks. The target repository is jackson-databind 2.13.5-tuxcare.3, which already contains the upstream fix. The two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) are present in the deserialization blacklist at SubTypeValidator.java lines 134-135. This fix was introduced by upstream vendor Tatu Saloranta in commit eb254813cc822d0af015ce8fe05febf50721dc53 and was already present in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:57:30.465792+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta gadget classes that could lead to arbitrary code execution via JNDI injection. The upstream fix (commit a424c038ba) that blacklists the three dangerous classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) was already present in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable code pattern is not present in the target repository because the upstream vendor (FasterXML) removed it before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves unsafe deserialization of ignite-jta gadget classes that could lead to arbitrary code execution via JNDI injection. The upstream fix (commit a424c038ba) that blacklists the three dangerous classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) was already present in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable code pattern is not present in the target repository because the upstream vendor (FasterXML) removed it before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 does not affect jackson-databind 2.13.5-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, which could enable arbitrary code execution through polymorphic type handling. The upstream vendor (FasterXML) fixed this by adding the dangerous class to SubTypeValidator's blocklist in commit 592872f4235 (March 2020). This fix was already present in the upstream 2.13.5 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 does not affect jackson-databind 2.13.5-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, which could enable arbitrary code execution through polymorphic type handling. The upstream vendor (FasterXML) fixed this by adding the dangerous class to SubTypeValidator's blocklist in commit 592872f4235 (March 2020). This fix was already present in the upstream 2.13.5 release that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:22:27.344203+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind version 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-10673. The vulnerability fix was already included in upstream release 2.13.5 before TuxCare onboarded it. The fix adds \"com.caucho.config.types.ResourceRef\" to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 167), preventing deserialization of this dangerous gadget class. The fix commit (1645efbd39) authored by upstream vendor Tatu Saloranta is an ancestor of the first TuxCare commit (b608fb38d7 \"Onboard version 2.13.5\"), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "Target repository jackson-databind version 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-10673. The vulnerability fix was already included in upstream release 2.13.5 before TuxCare onboarded it. The fix adds \"com.caucho.config.types.ResourceRef\" to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 167), preventing deserialization of this dangerous gadget class. The fix commit (1645efbd39) authored by upstream vendor Tatu Saloranta is an ancestor of the first TuxCare commit (b608fb38d7 \"Onboard version 2.13.5\"), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.aoju.bus.proxy.provider.remoting.RmiProvider). The target version 2.13.5-tuxcare.3 contains the upstream vendor's fix (commit 05d7e0e13f) that adds this gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 169-171). The fix was already present in the upstream release 2.13.5 before TuxCare onboarding (first TuxCare commit b608fb38d7 \"Onboard version 2.13.5\"). The blocklist is enforced via SubTypeValidator.validateSubType() which is invoked by BeanDeserializerFactory during bean deserialization, blocking instantiation of the dangerous class. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.aoju.bus.proxy.provider.remoting.RmiProvider). The target version 2.13.5-tuxcare.3 contains the upstream vendor's fix (commit 05d7e0e13f) that adds this gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 169-171). The fix was already present in the upstream release 2.13.5 before TuxCare onboarding (first TuxCare commit b608fb38d7 \"Onboard version 2.13.5\"). The blocklist is enforced via SubTypeValidator.validateSubType() which is invoked by BeanDeserializerFactory during bean deserialization, blocking instantiation of the dangerous class. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5 is not affected by CVE-2020-10969. The vulnerability (deserialization gadget via javax.swing.JEditorPane) is blocked by SubTypeValidator.java which includes JEditorPane in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 150. This fix was added by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) in commit 4d038c9de0a dated 2020-03-03, which was already present in upstream release 2.13.5 when TuxCare onboarded it (first TuxCare commit b608fb38d7c28f80bcb967028c46b8d64c913fab \"Onboard version 2.13.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target version 2.13.5 is not affected by CVE-2020-10969. The vulnerability (deserialization gadget via javax.swing.JEditorPane) is blocked by SubTypeValidator.java which includes JEditorPane in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 150. This fix was added by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) in commit 4d038c9de0a dated 2020-03-03, which was already present in upstream release 2.13.5 when TuxCare onboarded it (first TuxCare commit b608fb38d7c28f80bcb967028c46b8d64c913fab \"Onboard version 2.13.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.13.5. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The upstream vendor fix (blocking dangerous ActiveMQ classes in SubTypeValidator) was already included in version 2.9.10.4 (March 2020) and is present in the target version 2.13.5 (October 2022). All 9 dangerous ActiveMQ classes identified in the CVE are blocklisted in SubTypeValidator.java lines 175-183, preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release before TuxCare onboarded version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.13.5. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The upstream vendor fix (blocking dangerous ActiveMQ classes in SubTypeValidator) was already included in version 2.9.10.4 (March 2020) and is present in the target version 2.13.5 (October 2022). All 9 dangerous ActiveMQ classes identified in the CVE are blocklisted in SubTypeValidator.java lines 175-183, preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release before TuxCare onboarded version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability concerns deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider that can lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f by adding the class to SubTypeValidator's blacklist. This fix was already part of upstream version 2.13.5 when TuxCare onboarded it (first TuxCare commit b608fb38d7). The target version contains the defense at SubTypeValidator.java line 186, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability concerns deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider that can lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f by adding the class to SubTypeValidator's blacklist. This fix was already part of upstream version 2.13.5 when TuxCare onboarded it (first TuxCare commit b608fb38d7). The target version contains the defense at SubTypeValidator.java line 186, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The target version 2.13.5-tuxcare.3 is not affected because the upstream vendor (FasterXML) fixed this vulnerability in version 2.9.10.4, and the fix was already present in version 2.13.5 when TuxCare onboarded it. The blacklist entry is present at line 84 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The target version 2.13.5-tuxcare.3 is not affected because the upstream vendor (FasterXML) fixed this vulnerability in version 2.9.10.4, and the fix was already present in version 2.13.5 when TuxCare onboarded it. The blacklist entry is present at line 84 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5-tuxcare.3 is not affected by CVE-2020-11619. The vulnerability concerns Jackson deserialization gadgets using Spring Framework classes (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean). The fix that adds these classes to the deserialization blocklist was already present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. Both blocked classes appear in SubTypeValidator.java lines 53-54, preventing their instantiation during polymorphic deserialization. This is an upstream fix by the jackson-databind maintainer, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target version 2.13.5-tuxcare.3 is not affected by CVE-2020-11619. The vulnerability concerns Jackson deserialization gadgets using Spring Framework classes (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean). The fix that adds these classes to the deserialization blocklist was already present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. Both blocked classes appear in SubTypeValidator.java lines 53-54, preventing their instantiation during polymorphic deserialization. This is an upstream fix by the jackson-databind maintainer, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability affects versions before 2.9.10.4, but the target version 2.13.5 already includes the upstream fix (commit 77040d85e3) that adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java. This fix was shipped with the upstream 2.13.5 release and inherited by TuxCare during onboarding, not added as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability affects versions before 2.9.10.4, but the target version 2.13.5 already includes the upstream fix (commit 77040d85e3) that adds org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java. This fix was shipped with the upstream 2.13.5 release and inherited by TuxCare during onboarding, not added as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream fix was already included in jackson-databind 2.13.5 (released January 2023), which shipped with the blocklist entry preventing deserialization of this dangerous class. The fix was originally made by upstream maintainer Tatu Saloranta in April 2020 and propagated through all subsequent releases including 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream fix was already included in jackson-databind 2.13.5 (released January 2023), which shipped with the blocklist entry preventing deserialization of this dangerous class. The fix was originally made by upstream maintainer Tatu Saloranta in April 2020 and propagated through all subsequent releases including 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability involves deserialization of five Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The upstream vendor's fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.5 release that TuxCare onboarded, as confirmed by commit 5c8642aeae being an ancestor of the first TuxCare commit b608fb38d7 \"Onboard version 2.13.5\". The vulnerable pattern is not present because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "The target jackson-databind 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability involves deserialization of five Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The upstream vendor's fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.13.5 release that TuxCare onboarded, as confirmed by commit 5c8642aeae being an ancestor of the first TuxCare commit b608fb38d7 \"Onboard version 2.13.5\". The vulnerable pattern is not present because the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability concerns unsafe deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (xalan2 JNDI gadget). The fix was already included in the upstream jackson-databind 2.13.5 release via commit 840eae2ca81c597a0010b2126f32dce17d384b70 authored by Tatu Saloranta on May 1, 2020. The dangerous class is blocked at line 119 of SubTypeValidator.java, preventing the JNDI injection attack vector. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability concerns unsafe deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (xalan2 JNDI gadget). The fix was already included in the upstream jackson-databind 2.13.5 release via commit 840eae2ca81c597a0010b2126f32dce17d384b70 authored by Tatu Saloranta on May 1, 2020. The dangerous class is blocked at line 119 of SubTypeValidator.java, preventing the JNDI injection attack vector. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.5-tuxcare.3 is not affected by CVE-2020-14195. The vulnerability involves a deserialization gadget class (org.jsecurity.realm.jndi.JndiRealmFactory) that could enable JNDI-based remote code execution. The fix\u2014adding this class to SubTypeValidator's blocklist\u2014was included in the upstream release 2.13.5 and is present in the target at line 207 of SubTypeValidator.java. The blocklist is enforced in the core deserialization path before any bean instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "The target jackson-databind version 2.13.5-tuxcare.3 is not affected by CVE-2020-14195. The vulnerability involves a deserialization gadget class (org.jsecurity.realm.jndi.JndiRealmFactory) that could enable JNDI-based remote code execution. The fix\u2014adding this class to SubTypeValidator's blocklist\u2014was included in the upstream release 2.13.5 and is present in the target at line 207 of SubTypeValidator.java. The blocklist is enforced in the core deserialization path before any bean instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:16:29.503958+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPDataSource). The target repository is jackson-databind 2.13.5-tuxcare.3, which already contains the upstream fix. The fix (commit 3d97153944) was authored by upstream maintainer Tatu Saloranta on August 10, 2020, and was included in the upstream 2.13.5 release that TuxCare onboarded. The blocklist entry preventing deserialization of AnterosDBCPDataSource is present at line 147 of SubTypeValidator.java and is actively enforced by the validateSubType method. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPDataSource). The target repository is jackson-databind 2.13.5-tuxcare.3, which already contains the upstream fix. The fix (commit 3d97153944) was authored by upstream maintainer Tatu Saloranta on August 10, 2020, and was included in the upstream 2.13.5 release that TuxCare onboarded. The blocklist entry preventing deserialization of AnterosDBCPDataSource is present at line 147 of SubTypeValidator.java and is actively enforced by the validateSubType method. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:10.548488+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.13.5-tuxcare.3) is not affected by CVE-2020-24750. The vulnerability was fixed in upstream version 2.9.10.6 (August 2020) by adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.5 (January 2023) that TuxCare onboarded. Git history confirms the fix commit 6cc9f1a1af (July 2020, authored by upstream maintainer tatu.saloranta@iki.fi) is an ancestor of the TuxCare onboarding commit b608fb38d7, proving the fix shipped in the upstream release before TuxCare involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "The target (jackson-databind 2.13.5-tuxcare.3) is not affected by CVE-2020-24750. The vulnerability was fixed in upstream version 2.9.10.6 (August 2020) by adding com.pastdev.httpcomponents.configuration.JndiConfiguration to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream release 2.13.5 (January 2023) that TuxCare onboarded. Git history confirms the fix commit 6cc9f1a1af (July 2020, authored by upstream maintainer tatu.saloranta@iki.fi) is an ancestor of the TuxCare onboarding commit b608fb38d7, proving the fix shipped in the upstream release before TuxCare involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2020-25649 (XXE vulnerability via improper entity expansion in DOMDeserializer). The upstream fix (commit 612f971b78) that adds two critical XML parser security features to prevent XXE attacks was already included in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "The target jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2020-25649 (XXE vulnerability via improper entity expansion in DOMDeserializer). The upstream fix (commit 612f971b78) that adds two critical XML parser security features to prevent XXE attacks was already included in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:18:05.506292+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT affected by CVE-2020-35490. The upstream fix that blocks deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes was already present in version 2.13.5 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit 41b8bdb5 and shipped in the original 2.13.5 release. The CVE affects versions before 2.9.10.8, while this target is version 2.13.5 (much newer).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT affected by CVE-2020-35490. The upstream fix that blocks deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes was already present in version 2.13.5 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit 41b8bdb5 and shipped in the original 2.13.5 release. The CVE affects versions before 2.9.10.8, while this target is version 2.13.5 (much newer).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.13.5-tuxcare.2. The fix for this deserialization gadget vulnerability (blocking org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) was already included in the upstream FasterXML jackson-databind 2.13.5 release. The blocklist entries exist at SubTypeValidator.java lines 216-219 and are actively enforced during bean deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit 41b8bdb5) on 2020-12-15, well before TuxCare onboarded version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.13.5-tuxcare.2. The fix for this deserialization gadget vulnerability (blocking org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) was already included in the upstream FasterXML jackson-databind 2.13.5 release. The blocklist entries exist at SubTypeValidator.java lines 216-219 and are actively enforced during bean deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit 41b8bdb5) on 2020-12-15, well before TuxCare onboarded version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:52:27.107929+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.5-tuxcare.3 is not affected by CVE-2020-35728. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool, which enables JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit 1ca0388c2f by adding the malicious class to SubTypeValidator's deserialization blocklist. This fix was already present in upstream version 2.13.5 when TuxCare onboarded it (commit b608fb38d7), so the vulnerable code pattern never existed in the TuxCare maintenance branch. The CVE affects versions before 2.9.10.8; version 2.13.5 is significantly newer and includes the upstream fix at SubTypeValidator.java:240.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "Target version 2.13.5-tuxcare.3 is not affected by CVE-2020-35728. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool, which enables JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit 1ca0388c2f by adding the malicious class to SubTypeValidator's deserialization blocklist. This fix was already present in upstream version 2.13.5 when TuxCare onboarded it (commit b608fb38d7), so the vulnerable code pattern never existed in the TuxCare maintenance branch. The CVE affects versions before 2.9.10.8; version 2.13.5 is significantly newer and includes the upstream fix at SubTypeValidator.java:240.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not affecting this target. The vulnerability concerns Jackson's polymorphic deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related DriverAdapterCPDS variants. The upstream fix (commit 3ded28aece) that adds these classes to the SubTypeValidator blocklist was already present in jackson-databind 2.13.5 when TuxCare onboarded it. All five DriverAdapterCPDS variants are blocked in SubTypeValidator.java at lines 123, 193, 219, 228, and 234, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not affecting this target. The vulnerability concerns Jackson's polymorphic deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related DriverAdapterCPDS variants. The upstream fix (commit 3ded28aece) that adds these classes to the SubTypeValidator blocklist was already present in jackson-databind 2.13.5 when TuxCare onboarded it. All five DriverAdapterCPDS variants are blocked in SubTypeValidator.java at lines 123, 193, 219, 228, and 234, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:32:29.747187+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT vulnerable to CVE-2020-36180. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.13.5 release before TuxCare onboarded it. The fix adds org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS to the SubTypeValidator blocklist, preventing deserialization of this gadget class. The defense is present at line 219 of SubTypeValidator.java and is properly enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT vulnerable to CVE-2020-36180. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.13.5 release before TuxCare onboarded it. The fix adds org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS to the SubTypeValidator blocklist, preventing deserialization of this gadget class. The defense is present at line 219 of SubTypeValidator.java and is properly enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:38:23.121558+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36181. The vulnerability concerns deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, which could lead to remote code execution via JNDI injection. However, this class is already blocked in the target's SubTypeValidator.java (line 228) as part of the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3ded28aece and was already included in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target repository jackson-databind version 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36181. The vulnerability concerns deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, which could lead to remote code execution via JNDI injection. However, this class is already blocked in the target's SubTypeValidator.java (line 228) as part of the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3ded28aece and was already included in the upstream 2.13.5 release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:01.555768+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182: Target jackson-databind 2.13.5-tuxcare.3 is not affected. The fix for this deserialization gadget vulnerability was already present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entries for DBCP DriverAdapterCPDS classes) was never present in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182: Target jackson-databind 2.13.5-tuxcare.3 is not affected. The fix for this deserialization gadget vulnerability was already present in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entries for DBCP DriverAdapterCPDS classes) was never present in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:19:24.597800+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 affects jackson-databind versions before 2.9.10.8. The target repository is at version 2.13.5-tuxcare.3, which already contains the upstream fix. The blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool was added by upstream author Tatu Saloranta in commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 (Dec 31, 2020) and was already present in the upstream 2.13.5 release when TuxCare onboarded it. The vulnerable deserialization gadget is blocked in SubTypeValidator.java at line 243.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 affects jackson-databind versions before 2.9.10.8. The target repository is at version 2.13.5-tuxcare.3, which already contains the upstream fix. The blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool was added by upstream author Tatu Saloranta in commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 (Dec 31, 2020) and was already present in the upstream 2.13.5 release when TuxCare onboarded it. The vulnerable deserialization gadget is blocked in SubTypeValidator.java at line 243.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is not present in jackson-databind 2.13.5. The vulnerability involves deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 567194c53a (2020-12-26) by adding these classes to the SubTypeValidator blocklist. This fix was already included in the upstream 2.13.5 release and is present in the target code at lines 235-236 of SubTypeValidator.java. The blocklist mechanism is active by default and blocks deserialization attempts with a JsonMappingException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is not present in jackson-databind 2.13.5. The vulnerability involves deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 567194c53a (2020-12-26) by adding these classes to the SubTypeValidator blocklist. This fix was already included in the upstream 2.13.5 release and is present in the target code at lines 235-236 of SubTypeValidator.java. The blocklist mechanism is active by default and blocks deserialization attempts with a JsonMappingException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:02:25.196465+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target version 2.13.5-tuxcare.3 already contains the upstream fix (commit 567194c53a by Tatu Saloranta, Dec 26, 2020) which was included in the upstream 2.13.5 release. The vulnerable code pattern is not present because the fix shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target version 2.13.5-tuxcare.3 already contains the upstream fix (commit 567194c53a by Tatu Saloranta, Dec 26, 2020) which was included in the upstream 2.13.5 release. The vulnerable code pattern is not present because the fix shipped with the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:26:35.232279+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (blocklist entries for these classes in SubTypeValidator.java) was applied upstream by Tatu Saloranta on Dec 26, 2020 (commit 3e8fa3beea) and was already present in the upstream 2.13.5 release (Jan 22, 2023) that TuxCare onboarded. The target repository contains the complete fix at SubTypeValidator.java lines 229-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix (blocklist entries for these classes in SubTypeValidator.java) was applied upstream by Tatu Saloranta on Dec 26, 2020 (commit 3e8fa3beea) and was already present in the upstream 2.13.5 release (Jan 22, 2023) that TuxCare onboarded. The target repository contains the complete fix at SubTypeValidator.java lines 229-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:42:07.121820+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36187. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The fix (blocking these classes from deserialization) was implemented in upstream commit 3e8fa3beea4 by Tatu Saloranta on 2020-12-26 and shipped in upstream releases starting from version 2.12.1. This fix was already present in the upstream version 2.13.5 that TuxCare onboarded on 2026-09-17, so the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "The target repository jackson-databind version 2.13.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36187. The vulnerability involves deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The fix (blocking these classes from deserialization) was implemented in upstream commit 3e8fa3beea4 by Tatu Saloranta on 2020-12-26 and shipped in upstream releases starting from version 2.12.1. This fix was already present in the upstream version 2.13.5 that TuxCare onboarded on 2026-09-17, so the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:47:47.688279+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource that enable JNDI-based RCE. The upstream fix (commit 33d96c13fe by Tatu Saloranta, Dec 2020) added these classes to SubTypeValidator's deserialization blocklist. This fix was already included in upstream version 2.13.5 before TuxCare onboarded it (commit b608fb38d7 \"Onboard version 2.13.5\"). The blocklist is active in SubTypeValidator.java:223-224 and enforced via validateSubType() in the deserialization path, rejecting these gadget classes with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.13.5-tuxcare.3. The vulnerability involves deserialization gadgets com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource that enable JNDI-based RCE. The upstream fix (commit 33d96c13fe by Tatu Saloranta, Dec 2020) added these classes to SubTypeValidator's deserialization blocklist. This fix was already included in upstream version 2.13.5 before TuxCare onboarded it (commit b608fb38d7 \"Onboard version 2.13.5\"). The blocklist is active in SubTypeValidator.java:223-224 and enforced via validateSubType() in the deserialization path, rejecting these gadget classes with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:55:53.618169+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.5-tuxcare.2) is NOT vulnerable to CVE-2020-36189. The upstream fix that blocks deserialization of the two vulnerable gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) was already present in the upstream 2.13.5 release. The fix was introduced in upstream commit 33d96c13fe by Tatu Saloranta on December 26, 2020, and was included when TuxCare onboarded version 2.13.5. The vulnerable pattern is not present because the blacklist entries exist at lines 223-224 of SubTypeValidator.java and are properly enforced by the validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.5-tuxcare.2) is NOT vulnerable to CVE-2020-36189. The upstream fix that blocks deserialization of the two vulnerable gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource) was already present in the upstream 2.13.5 release. The fix was introduced in upstream commit 33d96c13fe by Tatu Saloranta on December 26, 2020, and was included when TuxCare onboarded version 2.13.5. The vulnerable pattern is not present because the blacklist entries exist at lines 223-224 of SubTypeValidator.java and are properly enforced by the validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:14:47.812204+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.13.5-tuxcare.3. The upstream vendor fix was already included in version 2.13.5 when TuxCare onboarded it. The fix introduces MAX_DEPTH=1000 limit and depth tracking to prevent stack overflow from deeply nested JSON structures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.13.5-tuxcare.3. The upstream vendor fix was already included in version 2.13.5 when TuxCare onboarded it. The fix introduces MAX_DEPTH=1000 limit and depth tracking to prevent stack overflow from deeply nested JSON structures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:07:58.117916+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.13.5-tuxcare.3. The fix for this vulnerability (blocking deserialization of org.apache.xbean.propertyeditor.JndiConverter) was already included in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. The blocklist entry is present at line 138 of SubTypeValidator.java, and the validation logic actively enforces it by throwing an exception when deserialization of the blocked class is attempted. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.13.5-tuxcare.3. The fix for this vulnerability (blocking deserialization of org.apache.xbean.propertyeditor.JndiConverter) was already included in the upstream jackson-databind 2.13.5 release that TuxCare onboarded. The blocklist entry is present at line 138 of SubTypeValidator.java, and the validation logic actively enforces it by throwing an exception when deserialization of the blocked class is attempted. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4. The target is jackson-databind 2.13.5-tuxcare.3, which already contains the upstream vendor fix. The vulnerable gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig is blocklisted in SubTypeValidator.java:141, preventing deserialization. This fix was authored by FasterXML maintainer Tatu Saloranta in commit 1e64db6a2f (Feb 29, 2020) and shipped in upstream release 2.13.5, predating TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4. The target is jackson-databind 2.13.5-tuxcare.3, which already contains the upstream vendor fix. The vulnerable gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig is blocklisted in SubTypeValidator.java:141, preventing deserialization. This fix was authored by FasterXML maintainer Tatu Saloranta in commit 1e64db6a2f (Feb 29, 2020) and shipped in upstream release 2.13.5, predating TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to a polymorphic deserialization gadget (com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig). The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the jackson-databind 2.13.5 release that TuxCare onboarded. The fix adds JtaTransactionConfig to the SubTypeValidator denylist, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to a polymorphic deserialization gadget (com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig). The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the jackson-databind 2.13.5 release that TuxCare onboarded. The fix adds JtaTransactionConfig to the SubTypeValidator denylist, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:47.660203+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.13.5. The vulnerability concerns a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPConfig) that enables arbitrary code execution when polymorphic type handling is enabled. The fix was included in upstream jackson-databind 2.9.10.4 (released Feb 2020), and version 2.13.5 (released Oct 2021, onboarded by TuxCare) already contains this fix. The blocklist entry exists at SubTypeValidator.java:145, preventing instantiation of the malicious class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.13.5. The vulnerability concerns a deserialization gadget (br.com.anteros.dbcp.AnterosDBCPConfig) that enables arbitrary code execution when polymorphic type handling is enabled. The fix was included in upstream jackson-databind 2.9.10.4 (released Feb 2020), and version 2.13.5 (released Oct 2021, onboarded by TuxCare) already contains this fix. The blocklist entry exists at SubTypeValidator.java:145, preventing instantiation of the malicious class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:07:22.154174+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.5 is NOT vulnerable to CVE-2021-20190. The vulnerability involved missing blocklist entries in SubTypeValidator.java for dangerous deserialization gadget classes (javax.swing.JTextPane and many others). The upstream vendor (FasterXML) fixed this in versions 2.9.10.7 and earlier. The target version 2.13.5 (released much later) already contains all the required blocklist entries in its upstream release. The fix was authored by tatu.saloranta@iki.fi and was present before TuxCare onboarded version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "The target jackson-databind version 2.13.5 is NOT vulnerable to CVE-2021-20190. The vulnerability involved missing blocklist entries in SubTypeValidator.java for dangerous deserialization gadget classes (javax.swing.JTextPane and many others). The upstream vendor (FasterXML) fixed this in versions 2.9.10.7 and earlier. The target version 2.13.5 (released much later) already contains all the required blocklist entries in its upstream release. The fix was authored by tatu.saloranta@iki.fi and was present before TuxCare onboarded version 2.13.5.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT affected by CVE-2021-46877. The vulnerability pattern (direct allocation of byte arrays based on untrusted length fields during JDK deserialization) is not present in the target. The fix was already included in the upstream jackson-databind 2.13.5 release, which TuxCare onboarded. The fix commit (3ccde7d938) by upstream author Tatu Saloranta predates the first TuxCare commit in this branch's history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.5-tuxcare.3) is NOT affected by CVE-2021-46877. The vulnerability pattern (direct allocation of byte arrays based on untrusted length fields during JDK deserialization) is not present in the target. The fix was already included in the upstream jackson-databind 2.13.5 release, which TuxCare onboarded. The fix commit (3ccde7d938) by upstream author Tatu Saloranta predates the first TuxCare commit in this branch's history."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:20.075693+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 affects jackson-databind versions 2.13.x before 2.13.4.2 due to missing depth checks in primitive deserializers when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.13.5-tuxcare.3 is NOT affected because the upstream fix (commit 2c4a601c62) shipped in version 2.13.4.1 and is present in the 2.13.5 release that TuxCare onboarded. The fix adds handleNestedArrayForSingle() method and modifies all primitive deserializers (boolean, byte, short, int, long, float, double, Date) to detect and reject nested START_ARRAY tokens, preventing resource exhaustion from deep array nesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 affects jackson-databind versions 2.13.x before 2.13.4.2 due to missing depth checks in primitive deserializers when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.13.5-tuxcare.3 is NOT affected because the upstream fix (commit 2c4a601c62) shipped in version 2.13.4.1 and is present in the 2.13.5 release that TuxCare onboarded. The fix adds handleNestedArrayForSingle() method and modifies all primitive deserializers (boolean, byte, short, int, long, float, double, Date) to detect and reject nested START_ARRAY tokens, preventing resource exhaustion from deep array nesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:56:41.580238+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2022-42004. The upstream vendor (FasterXML) fixed this vulnerability in commit 063183589218fec19a9293ed2f17ec53ea80ba88 (authored by Tatu Saloranta) before the 2.13.5 release. The fix was already present when TuxCare onboarded version 2.13.5 in commit b608fb38d7c28f80bcb967028c46b8d64c913fab. The vulnerable pattern (lack of check for deeply nested arrays in BeanDeserializer._deserializeFromArray when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) is not present in HEAD because the fix adds a check at line 634 that rejects a second START_ARRAY token, preventing unbounded recursive unwrapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "The target jackson-databind 2.13.5-tuxcare.3 is not affected by CVE-2022-42004. The upstream vendor (FasterXML) fixed this vulnerability in commit 063183589218fec19a9293ed2f17ec53ea80ba88 (authored by Tatu Saloranta) before the 2.13.5 release. The fix was already present when TuxCare onboarded version 2.13.5 in commit b608fb38d7c28f80bcb967028c46b8d64c913fab. The vulnerable pattern (lack of check for deeply nested arrays in BeanDeserializer._deserializeFromArray when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) is not present in HEAD because the fix adds a check at line 634 that rejects a second START_ARRAY token, preventing unbounded recursive unwrapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:46:00.120783+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:48:00.129538+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:46:00.120783+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:47:00.120609+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:47:00.120609+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:47:00.120609+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:47:00.120609+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:56:36.133777+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.5 is NOT affected by CVE-2026-54518. The vulnerability requires the @JsonUnwrapped + @JsonCreator feature, which was explicitly not supported in 2.13.5 and was only added 1.5 years later (November 2024, commit 502fe888da). The code comment in deserializeUsingPropertyBasedWithUnwrapped() explicitly states \"unwrapped value itself is NOT passed via CreatorProperty (which isn't support...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.13.5 is NOT affected by CVE-2026-54518. The vulnerability requires the @JsonUnwrapped + @JsonCreator feature, which was explicitly not supported in 2.13.5 and was only added 1.5 years later (November 2024, commit 502fe888da). The code comment in deserializeUsingPropertyBasedWithUnwrapped() explicitly states \"unwrapped value itself is NOT passed via CreatorProperty (which isn't support..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T11:09:22.293853+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:48:00.129538+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:46:00.120783+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:02:53.178012+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:48:00.129538+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T12:29:41.999302+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T12:29:00.173266+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.5-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:48:00.129538+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.5-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}