{
  "@id": "urn:uuid:e4bb28b9-d1bd-498a-83d4-5a328c8f9b17",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 84,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:08:47.794831+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.14.3. The vulnerability affects versions prior to 2.8.11 and 2.9.4. The target version (2.14.3) already contains the upstream fixes that added comprehensive blacklisting of dangerous classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring types, C3P0 types) to prevent polymorphic deserialization attacks. The blacklist mechanism exists in SubTypeValidator.java (lines 30-305) and is actively enforced during bean deserialization. The fixes were authored by the upstream vendor (FasterXML) and shipped in the upstream release 2.14.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.14.3. The vulnerability affects versions prior to 2.8.11 and 2.9.4. The target version (2.14.3) already contains the upstream fixes that added comprehensive blacklisting of dangerous classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring types, C3P0 types) to prevent polymorphic deserialization attacks. The blacklist mechanism exists in SubTypeValidator.java (lines 30-305) and is actively enforced during bean deserialization. The fixes were authored by the upstream vendor (FasterXML) and shipped in the upstream release 2.14.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:44:21.734688+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.14.3 is not affected by CVE-2017-17485. The vulnerability (incomplete deserialization blacklist allowing remote code execution via Spring/C3P0/JDK gadget classes) was fixed in upstream releases 2.7.9.2, 2.8.11, and 2.9.4 (December 2017). The complete fix\u2014including SubTypeValidator class with blacklist entries and pattern-based validation for Spring AbstractPointcutAdvisor/AbstractApplicationContext and C3P0 DataSource classes\u2014was already present in the upstream release 2.14.3 that TuxCare onboarded. The fix commits (e865a7a446, 2235894210, etc.) are ancestors of HEAD and were authored by upstream FasterXML maintainers, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target jackson-databind 2.14.3 is not affected by CVE-2017-17485. The vulnerability (incomplete deserialization blacklist allowing remote code execution via Spring/C3P0/JDK gadget classes) was fixed in upstream releases 2.7.9.2, 2.8.11, and 2.9.4 (December 2017). The complete fix\u2014including SubTypeValidator class with blacklist entries and pattern-based validation for Spring AbstractPointcutAdvisor/AbstractApplicationContext and C3P0 DataSource classes\u2014was already present in the upstream release 2.14.3 that TuxCare onboarded. The fix commits (e865a7a446, 2235894210, etc.) are ancestors of HEAD and were authored by upstream FasterXML maintainers, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:27:17.200297+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.14.3. The vulnerability, which allowed arbitrary code execution through deserialization of dangerous gadget classes (like TemplatesImpl), was fixed in the upstream release. The target contains SubTypeValidator with a comprehensive blocklist that prevents deserialization of these dangerous classes. This fix was authored by the upstream maintainer (Tatu Saloranta) and shipped in the original 2.14.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.14.3. The vulnerability, which allowed arbitrary code execution through deserialization of dangerous gadget classes (like TemplatesImpl), was fixed in the upstream release. The target contains SubTypeValidator with a comprehensive blocklist that prevents deserialization of these dangerous classes. This fix was authored by the upstream maintainer (Tatu Saloranta) and shipped in the original 2.14.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.14.3. The vulnerable iBatis XPathParser gadget class is blacklisted in SubTypeValidator.java (line 65), preventing deserialization attacks. This fix was provided by upstream maintainer Tatu Saloranta in commit 27b4defc270 and shipped in the upstream 2.14.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.14.3. The vulnerable iBatis XPathParser gadget class is blacklisted in SubTypeValidator.java (line 65), preventing deserialization attacks. This fix was provided by upstream maintainer Tatu Saloranta in commit 27b4defc270 and shipped in the upstream 2.14.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:18:37.716688+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows remote code execution via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The target repository is jackson-databind version 2.14.3, which already contains the upstream fix. The fix was shipped by FasterXML in the upstream release, not backported by TuxCare. SubTypeValidator.java (lines 67-72) contains the required blacklist entries blocking jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. The fix commit (7487cf7eb1) by upstream author tatu.saloranta@iki.fi is an ancestor of the TuxCare onboarding commit, confirming the fix was already present in version 2.14.3 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows remote code execution via polymorphic deserialization of Jodd-db gadget classes when Default Typing is enabled. The target repository is jackson-databind version 2.14.3, which already contains the upstream fix. The fix was shipped by FasterXML in the upstream release, not backported by TuxCare. SubTypeValidator.java (lines 67-72) contains the required blacklist entries blocking jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. The fix commit (7487cf7eb1) by upstream author tatu.saloranta@iki.fi is an ancestor of the TuxCare onboarding commit, confirming the fix was already present in version 2.14.3 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:20:17.888209+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves polymorphic deserialization of Oracle JDBC and Jodd-db classes that can trigger JNDI/LDAP injection leading to remote code execution. The upstream fix (commit 28badf7ef6, June 2018) added these dangerous classes to the SubTypeValidator deny list, blocking their instantiation during deserialization. This fix was already present in the upstream release 2.7.9.4 and all subsequent versions including 2.14.3, which TuxCare onboarded. The vulnerable code pattern (unrestricted deserialization of these classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves polymorphic deserialization of Oracle JDBC and Jodd-db classes that can trigger JNDI/LDAP injection leading to remote code execution. The upstream fix (commit 28badf7ef6, June 2018) added these dangerous classes to the SubTypeValidator deny list, blocking their instantiation during deserialization. This fix was already present in the upstream release 2.7.9.4 and all subsequent versions including 2.14.3, which TuxCare onboarded. The vulnerable code pattern (unrestricted deserialization of these classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:50:27.486705+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3-tuxcare.1 is NOT affected by CVE-2018-14718. The vulnerability (allowing polymorphic deserialization of org.slf4j.ext.EventData and other dangerous classes) has been fixed by upstream commit 87d29af25e from August 2018. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. The fix adds \"org.slf4j.ext.EventData\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 75), which is enforced during bean deserialization via BeanDeserializerFactory._validateSubType() at line 141. When a blocked class is detected, the framework throws a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\". The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target jackson-databind 2.14.3-tuxcare.1 is NOT affected by CVE-2018-14718. The vulnerability (allowing polymorphic deserialization of org.slf4j.ext.EventData and other dangerous classes) has been fixed by upstream commit 87d29af25e from August 2018. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. The fix adds \"org.slf4j.ext.EventData\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 75), which is enforced during bean deserialization via BeanDeserializerFactory._validateSubType() at line 141. When a blocked class is detected, the framework throws a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\". The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:00:30.548174+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3 is NOT affected by CVE-2018-14719. The upstream fix (commit 87d29af25e by Tatu Saloranta) was already included in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. The dangerous BlazeDS class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 76) and will be rejected during polymorphic deserialization via the validateSubType method, which is called by BeanDeserializerFactory during bean deserializer creation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "Target version 2.14.3 is NOT affected by CVE-2018-14719. The upstream fix (commit 87d29af25e by Tatu Saloranta) was already included in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. The dangerous BlazeDS class `flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor` is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 76) and will be rejected during polymorphic deserialization via the validateSubType method, which is called by BeanDeserializerFactory during bean deserializer creation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:07:52.803278+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involved unsafe polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks. The fix blocking these classes was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. Commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream maintainer Tatu Saloranta added all four classes to the deserialization blocklist before the TuxCare onboarding, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involved unsafe polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks. The fix blocking these classes was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. Commit 87d29af25e82a249ea15858e2d4ecbf64091db44 by upstream maintainer Tatu Saloranta added all four classes to the deserialization blocklist before the TuxCare onboarding, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:37:15.372164+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 (SSRF via org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl polymorphic deserialization) is NOT AFFECTED in jackson-databind 2.14.3. The upstream vendor fix (commit 87d29af25e) was already included in the upstream release 2.14.3 that TuxCare onboarded. The dangerous class is blocklisted in SubTypeValidator.java line 78, and the validation is actively enforced during deserialization via BeanDeserializerFactory line 1032. The vulnerable pattern (missing blocklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 (SSRF via org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl polymorphic deserialization) is NOT AFFECTED in jackson-databind 2.14.3. The upstream vendor fix (commit 87d29af25e) was already included in the upstream release 2.14.3 that TuxCare onboarded. The dangerous class is blocklisted in SubTypeValidator.java line 78, and the validation is actively enforced during deserialization via BeanDeserializerFactory line 1032. The vulnerable pattern (missing blocklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:48:08.430268+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.14.3. The vulnerability requires the absence of a blocklist entry for 'org.apache.axis2.transport.jms.JMSOutTransportInfo' in SubTypeValidator.java. This blocklist entry is present at line 85 of the target's SubTypeValidator.java file, preventing polymorphic deserialization of the dangerous class. The fix was already included in the upstream jackson-databind 2.14.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.14.3. The vulnerability requires the absence of a blocklist entry for 'org.apache.axis2.transport.jms.JMSOutTransportInfo' in SubTypeValidator.java. This blocklist entry is present at line 85 of the target's SubTypeValidator.java file, preventing polymorphic deserialization of the dangerous class. The fix was already included in the upstream jackson-databind 2.14.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:56:06.275906+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns polymorphic deserialization of org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime classes. These classes are already blocklisted in SubTypeValidator.java (lines 82-83), preventing their deserialization. The fix was introduced by upstream FasterXML in commit 72cd4025a2 (Fix #2186) and was already present in the upstream 2.14.3 release before TuxCare onboarded it (commit 0c8533d1 by amoniatovskiy@cloudlinux.com). The blocklist is enforced during bean deserialization via BeanDeserializerFactory.java:1032 calling SubTypeValidator.instance().validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns polymorphic deserialization of org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime classes. These classes are already blocklisted in SubTypeValidator.java (lines 82-83), preventing their deserialization. The fix was introduced by upstream FasterXML in commit 72cd4025a2 (Fix #2186) and was already present in the upstream 2.14.3 release before TuxCare onboarded it (commit 0c8533d1 by amoniatovskiy@cloudlinux.com). The blocklist is enforced during bean deserialization via BeanDeserializerFactory.java:1032 calling SubTypeValidator.instance().validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:24:24.833839+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3 is NOT vulnerable to CVE-2018-19362. The fix was already present in the upstream release 2.14.3 before TuxCare onboarded it. The vulnerable gadget classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) are properly blacklisted in SubTypeValidator.java lines 80-85, preventing their use in polymorphic deserialization. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "Target version 2.14.3 is NOT vulnerable to CVE-2018-19362. The fix was already present in the upstream release 2.14.3 before TuxCare onboarded it. The vulnerable gadget classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) are properly blacklisted in SubTypeValidator.java lines 80-85, preventing their use in polymorphic deserialization. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind version 2.14.3. The vulnerability allows remote code execution via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The upstream fix (commit 038b471e2ef by Tatu Saloranta, dated 2018-01-21) added these two class names to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.14.3 before TuxCare onboarded it (first TuxCare commit: 0c8533d1, \"Onboard version 2.14.3\"). The blacklist check is enforced in validateSubType() at line 269, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind version 2.14.3. The vulnerability allows remote code execution via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The upstream fix (commit 038b471e2ef by Tatu Saloranta, dated 2018-01-21) added these two class names to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.14.3 before TuxCare onboarded it (first TuxCare commit: 0c8533d1, \"Onboard version 2.14.3\"). The blacklist check is enforced in validateSubType() at line 269, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:23.146908+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3 is not affected by CVE-2018-7489. The vulnerability (missing validation for c3p0 DataSource gadget classes) was fixed by upstream in versions prior to 2.14.3. The fix is present in SubTypeValidator.java lines 288-297, blocking deserialization of classes matching \"com.mchange.v2.c3p0.*DataSource\" pattern. Fix commit 6799f8f10c by upstream author Tatu Saloranta was already included in upstream release 2.14.3 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target version 2.14.3 is not affected by CVE-2018-7489. The vulnerability (missing validation for c3p0 DataSource gadget classes) was fixed by upstream in versions prior to 2.14.3. The fix is present in SubTypeValidator.java lines 288-297, blocking deserialization of classes matching \"com.mchange.v2.c3p0.*DataSource\" pattern. Fix commit 6799f8f10c by upstream author Tatu Saloranta was already included in upstream release 2.14.3 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:32:27.596761+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.14.3 contains the upstream fix that blacklists com.mysql.cj.jdbc.admin.MiniAdmin (line 88 of SubTypeValidator.java). This fix was introduced in upstream version 2.9.9 by Tatu Saloranta (commit dda513bd) and was already present in the upstream release 2.14.3 when TuxCare onboarded it. The vulnerable pattern (missing blacklist entry for MiniAdmin) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.14.3 contains the upstream fix that blacklists com.mysql.cj.jdbc.admin.MiniAdmin (line 88 of SubTypeValidator.java). This fix was introduced in upstream version 2.9.9 by Tatu Saloranta (commit dda513bd) and was already present in the upstream release 2.14.3 when TuxCare onboarded it. The vulnerable pattern (missing blacklist entry for MiniAdmin) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:34:00.203958+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.14.3. The vulnerability involves polymorphic deserialization of the logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource`, which could lead to RCE. The upstream fix (commit c9ef4a10d6) added this class to the blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already pres...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.14.3. The vulnerability involves polymorphic deserialization of the logback-core class `ch.qos.logback.core.db.DriverManagerConnectionSource`, which could lead to RCE. The upstream fix (commit c9ef4a10d6) added this class to the blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already pres..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:17:48.124772+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.14.3 is NOT affected by CVE-2019-12814. The vulnerability, which allowed arbitrary file reading through JDOM XSLTransformer gadget classes during polymorphic deserialization, was fixed by upstream maintainer Tatu Saloranta in commit 5f7c69bba07. This fix was already present in the upstream release 2.14.3 when TuxCare onboarded it. The JDOM XSLTransformer cl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind version 2.14.3 is NOT affected by CVE-2019-12814. The vulnerability, which allowed arbitrary file reading through JDOM XSLTransformer gadget classes during polymorphic deserialization, was fixed by upstream maintainer Tatu Saloranta in commit 5f7c69bba07. This fix was already present in the upstream release 2.14.3 when TuxCare onboarded it. The JDOM XSLTransformer cl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:09:40.812233+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns deserialization of the malicious ehcache class 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup'. The upstream fix (commit ad418eeb97 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, and this fix was already included in the upstream 2.14.3 release before TuxCare onboarded it. The validateSubType method at lines 269-270 blocks any attempt to deserialize blacklisted classes, preventing the attack chain from INPUT (JSON with polymorphic type info) to GOAL (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns deserialization of the malicious ehcache class 'net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup'. The upstream fix (commit ad418eeb97 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, and this fix was already included in the upstream 2.14.3 release before TuxCare onboarded it. The validateSubType method at lines 269-270 blocks any attempt to deserialize blacklisted classes, preventing the attack chain from INPUT (JSON with polymorphic type info) to GOAL (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target version 2.14.3-tuxcare.1 includes the upstream fix (commit ad418eeb97) that adds ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blacklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.9.2 (July 2019), well before the 2.14.3 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2. The target version 2.14.3-tuxcare.1 includes the upstream fix (commit ad418eeb97) that adds ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blacklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.9.2 (July 2019), well before the 2.14.3 release that TuxCare onboarded. The vulnerable code pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:47:24.883937+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to missing blacklist entries for HikariCP classes in polymorphic deserialization. The target version 2.14.3 already contains the upstream fix (commits d4983c740f and 73c1c2cc76) that adds com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. These fixes were part of upstream release 2.10.0 and were already present in the 2.14.3 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entries) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to missing blacklist entries for HikariCP classes in polymorphic deserialization. The target version 2.14.3 already contains the upstream fix (commits d4983c740f and 73c1c2cc76) that adds com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. These fixes were part of upstream release 2.10.0 and were already present in the 2.14.3 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entries) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:54:42.566702+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.14.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. Version 2.14.3 is well after 2.9.10 and includes the upstream fix (commit 41b7f9b901) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream developer Tatu Saloranta and was already present in the upstream release when TuxCare onboarded version 2.14.3. The blocklist prevents polymorphic deserialization of these JNDI classes, blocking the arbitrary code execution attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.14.3. The vulnerability affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3. Version 2.14.3 is well after 2.9.10 and includes the upstream fix (commit 41b7f9b901) that adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream developer Tatu Saloranta and was already present in the upstream release when TuxCare onboarded version 2.14.3. The blocklist prevents polymorphic deserialization of these JNDI classes, blocking the arbitrary code execution attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3-tuxcare.1 is NOT AFFECTED by CVE-2019-14893. The xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) is already blocklisted in SubTypeValidator.java at line 117. This fix (commit 998efd7082) was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream jackson-databind 2.14.3 release, which TuxCare later onboarded. The vulnerable pattern (ability to deserialize the xalan JNDI gadget via polymorphic typing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "Target version 2.14.3-tuxcare.1 is NOT AFFECTED by CVE-2019-14893. The xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) is already blocklisted in SubTypeValidator.java at line 117. This fix (commit 998efd7082) was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream jackson-databind 2.14.3 release, which TuxCare later onboarded. The vulnerable pattern (ability to deserialize the xalan JNDI gadget via polymorphic typing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:05:23.635575+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource as a gadget class. The fix (adding HikariDataSource to the blacklist in SubTypeValidator.java line 107) was already present in the upstream 2.14.3 release when TuxCare onboarded it. The fixing commit (73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db \"Fix #2449\") was authored by upstream maintainer Tatu Saloranta and is an ancestor of the TuxCare onboarding commit (0c8533d168 \"Onboard version 2.14.3\"). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource as a gadget class. The fix (adding HikariDataSource to the blacklist in SubTypeValidator.java line 107) was already present in the upstream 2.14.3 release when TuxCare onboarded it. The fixing commit (73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db \"Fix #2449\") was authored by upstream maintainer Tatu Saloranta and is an ancestor of the TuxCare onboarding commit (0c8533d168 \"Onboard version 2.14.3\"). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:04:56.336983+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 does not affect jackson-databind 2.14.3-tuxcare.1. The vulnerability involves deserialization gadget classes from commons-dbcp that could enable RCE when polymorphic typing is enabled. The fix, which adds PerUserPoolDataSource, SharedPoolDataSource, and P6DataSource to the deserialization blacklist in SubTypeValidator.java, was implemented by upstream vendor Tatu Saloranta in commit 9593e16cf5 (September 2019) and shipped in upstream release 2.10.1. Since the target version 2.14.3 is much newer (released May 2023), it includes this upstream fix by default. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 does not affect jackson-databind 2.14.3-tuxcare.1. The vulnerability involves deserialization gadget classes from commons-dbcp that could enable RCE when polymorphic typing is enabled. The fix, which adds PerUserPoolDataSource, SharedPoolDataSource, and P6DataSource to the deserialization blacklist in SubTypeValidator.java, was implemented by upstream vendor Tatu Saloranta in commit 9593e16cf5 (September 2019) and shipped in upstream release 2.10.1. Since the target version 2.14.3 is much newer (released May 2023), it includes this upstream fix by default. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:14:51.865228+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSources) that can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commits 9593e16cf5 and 328a0f833d by adding these class names to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSources) that can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commits 9593e16cf5 and 328a0f833d by adding these class names to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 does NOT affect jackson-databind 2.14.3. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87) added this class to the SubTypeValidator blocklist and was already present in version 2.14.3 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare/CloudLinux. Target version 2.14.3 is well after the affected versions (before 2.9.10 and 2.8.11.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 does NOT affect jackson-databind 2.14.3. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87) added this class to the SubTypeValidator blocklist and was already present in version 2.14.3 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not by TuxCare/CloudLinux. Target version 2.14.3 is well after the affected versions (before 2.9.10 and 2.8.11.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:48:05.007690+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.14.3. The vulnerability involves deserialization of malicious log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) that can lead to arbitrary code execution via JNDI injection. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) adds these two classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded (commit 0c8533d168), so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.14.3. The vulnerability involves deserialization of malicious log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) that can lead to arbitrary code execution via JNDI injection. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) adds these two classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded (commit 0c8533d168), so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that can be exploited via polymorphic deserialization to achieve arbitrary code execution through JNDI injection. The upstream fix adds these class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream release 2.14.3 before TuxCare onboarding, as evidenced by commit fc4214a883dc087070f25da738ef0d49c2f3387e (authored by Tatu Saloranta on Nov 1, 2019) being an ancestor of the first TuxCare commit 0c8533d168e2464e8ce5925eacd9601d5736ca63 (\"Onboard version 2.14.3\"). The blocklist entries are present at SubTypeValidator.java:134-135 and are enforced unconditionally during deserialization via BeanDeserializerFactory._validateSubType(), which throws JsonMappingException for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that can be exploited via polymorphic deserialization to achieve arbitrary code execution through JNDI injection. The upstream fix adds these class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream release 2.14.3 before TuxCare onboarding, as evidenced by commit fc4214a883dc087070f25da738ef0d49c2f3387e (authored by Tatu Saloranta on Nov 1, 2019) being an ancestor of the first TuxCare commit 0c8533d168e2464e8ce5925eacd9601d5736ca63 (\"Onboard version 2.14.3\"). The blocklist entries are present at SubTypeValidator.java:134-135 and are enforced unconditionally during deserialization via BeanDeserializerFactory._validateSubType(), which throws JsonMappingException for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:02:28.386699+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3 is NOT affected by CVE-2020-10650. The vulnerability involves unsafe deserialization of JNDI-related classes from ignite-jta and quartz-core that could lead to remote code execution. The upstream fix (commit a424c038ba by Tatu Saloranta) added three classes to the deserialization blacklist in SubTypeValidator.java: CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider. This fix was already present in the upstream release 2.14.3 when TuxCare onboarded it (first TuxCare commit 0c8533d168). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target jackson-databind 2.14.3 is NOT affected by CVE-2020-10650. The vulnerability involves unsafe deserialization of JNDI-related classes from ignite-jta and quartz-core that could lead to remote code execution. The upstream fix (commit a424c038ba by Tatu Saloranta) added three classes to the deserialization blacklist in SubTypeValidator.java: CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider. This fix was already present in the upstream release 2.14.3 when TuxCare onboarded it (first TuxCare commit 0c8533d168). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3-tuxcare.1 is not affected by CVE-2020-10672. The vulnerability concerns deserialization gadgets in org.apache.aries.transaction.jms classes that can be exploited through Jackson's polymorphic typing feature. The fix was already present in upstream version 2.14.3 before TuxCare onboarded it. Both dangerous classes (XaPooledConnectionFactory and RecoverablePooledConnectionFactory) are blocklisted in SubTypeValidator.java at lines 163-164, preventing their deserialization and thus blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target jackson-databind 2.14.3-tuxcare.1 is not affected by CVE-2020-10672. The vulnerability concerns deserialization gadgets in org.apache.aries.transaction.jms classes that can be exploited through Jackson's polymorphic typing feature. The fix was already present in upstream version 2.14.3 before TuxCare onboarded it. Both dangerous classes (XaPooledConnectionFactory and RecoverablePooledConnectionFactory) are blocklisted in SubTypeValidator.java at lines 163-164, preventing their deserialization and thus blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for com.caucho.config.types.ResourceRef in SubTypeValidator. The target version 2.14.3-tuxcare.1 contains the upstream fix (commit 1645efbd39) that was shipped in jackson-databind 2.10.4 and all later releases. The fix adds \"com.caucho.config.types.ResourceRef\" to the DEFAULT_NO_DESER_CLASS_NAMES blacklist at line 167 of SubTypeValidator.java. This is an upstream fix by Tatu Saloranta that was already present in the jackson-databind 2.14.3 release onboarded by TuxCare, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entry for com.caucho.config.types.ResourceRef in SubTypeValidator. The target version 2.14.3-tuxcare.1 contains the upstream fix (commit 1645efbd39) that was shipped in jackson-databind 2.10.4 and all later releases. The fix adds \"com.caucho.config.types.ResourceRef\" to the DEFAULT_NO_DESER_CLASS_NAMES blacklist at line 167 of SubTypeValidator.java. This is an upstream fix by Tatu Saloranta that was already present in the jackson-databind 2.14.3 release onboarded by TuxCare, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4, involving deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository is jackson-databind version 2.14.3-tuxcare.1, which already contains the upstream vendor fix. The fix adds two RmiProvider class names to the SubTypeValidator blocklist (lines 169-171), preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 05d7e0e13f on 2020-03-25 and was already present in the upstream release 2.14.3 that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target because these dangerous classes are explicitly blocklisted and cannot be instantiated during JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4, involving deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository is jackson-databind version 2.14.3-tuxcare.1, which already contains the upstream vendor fix. The fix adds two RmiProvider class names to the SubTypeValidator blocklist (lines 169-171), preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 05d7e0e13f on 2020-03-25 and was already present in the upstream release 2.14.3 that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target because these dangerous classes are explicitly blocklisted and cannot be instantiated during JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 (javax.swing.JEditorPane deserialization gadget) is not present in jackson-databind version 2.14.3-tuxcare.1. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.10.4 (March 2020) by adding \"javax.swing.JEditorPane\" to the deserialization blocklist in SubTypeValidator.java. The target version 2.14.3 inherited this fix from the upstream release, with the blocklist entry present at lines 149-151 of SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream) and predates TuxCare's onboarding of version 2.14.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 (javax.swing.JEditorPane deserialization gadget) is not present in jackson-databind version 2.14.3-tuxcare.1. The upstream vendor (FasterXML) fixed this vulnerability in version 2.9.10.4 (March 2020) by adding \"javax.swing.JEditorPane\" to the deserialization blocklist in SubTypeValidator.java. The target version 2.14.3 inherited this fix from the upstream release, with the blocklist entry present at lines 149-151 of SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream) and predates TuxCare's onboarding of version 2.14.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.14.3. The vulnerability involves deserialization of org.apache.activemq.* gadget classes through polymorphic typing. The upstream fix (commit c14c9f99ed by Tatu Saloranta, March 2020) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already in upstream jackson-databind 2.14.3 (released May 2023) when TuxCare onboarded the version in commit 0c8533d168. The blocklist validation is enforced at SubTypeValidator.java:269, throwing JsonMappingException for blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.14.3. The vulnerability involves deserialization of org.apache.activemq.* gadget classes through polymorphic typing. The upstream fix (commit c14c9f99ed by Tatu Saloranta, March 2020) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already in upstream jackson-databind 2.14.3 (released May 2023) when TuxCare onboarded the version in commit 0c8533d168. The blocklist validation is enforced at SubTypeValidator.java:269, throwing JsonMappingException for blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The upstream fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 by Tatu Saloranta, March 25, 2020) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.14.3 release that TuxCare onboarded (first TuxCare commit: 0c8533d168e2464e8ce5925eacd9601d5736ca63 \"Onboard version 2.14.3\"). The blocklist entry is at SubTypeValidator.java line 186, and the defense is always active (hardcoded singleton, no configuration bypass). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability concerns deserialization of the gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The upstream fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 by Tatu Saloranta, March 25, 2020) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.14.3 release that TuxCare onboarded (first TuxCare commit: 0c8533d168e2464e8ce5925eacd9601d5736ca63 \"Onboard version 2.14.3\"). The blocklist entry is at SubTypeValidator.java line 186, and the defense is always active (hardcoded singleton, no configuration bypass). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.14.3-tuxcare.1) is not affected by CVE-2020-11113. The vulnerability involves Jackson's polymorphic deserialization allowing exploitation via the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix that adds this class to the deserialization blocklist in SubTypeValidator.java was already present in the upstream 2.14.3 release when TuxCare onboarded it. The fix commit (e2ba12d5d60715d95105e3e790fc234cfb59893d, March 2020) by upstream maintainer Tatu Saloranta predates the TuxCare onboarding commit by years. Since version 2.14.3 was released in early 2023, it inherently includes all security fixes from 2020, making it immune to this 2020-era deserialization gadget vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target (jackson-databind 2.14.3-tuxcare.1) is not affected by CVE-2020-11113. The vulnerability involves Jackson's polymorphic deserialization allowing exploitation via the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix that adds this class to the deserialization blocklist in SubTypeValidator.java was already present in the upstream 2.14.3 release when TuxCare onboarded it. The fix commit (e2ba12d5d60715d95105e3e790fc234cfb59893d, March 2020) by upstream maintainer Tatu Saloranta predates the TuxCare onboarding commit by years. Since version 2.14.3 was released in early 2023, it inherently includes all security fixes from 2020, making it immune to this 2020-era deserialization gadget vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3 is NOT affected by CVE-2020-11619. The vulnerability involves deserialization of malicious Spring Framework bean classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) that can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 113e89fb08 by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare commit (0c8533d168 \"Onboard version 2.14.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target jackson-databind 2.14.3 is NOT affected by CVE-2020-11619. The vulnerability involves deserialization of malicious Spring Framework bean classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) that can lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 113e89fb08 by adding these classes to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare commit (0c8533d168 \"Onboard version 2.14.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected by CVE-2020-11620. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this vulnerability by adding \"org.apache.commons.jelly.impl.Embedded\" to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.14.3 release before TuxCare onboarded it. The fix commit (77040d85e3) was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the FasterXML maintainer, and is an ancestor of the TuxCare onboarding commit. The vulnerable pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected by CVE-2020-11620. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.jelly.impl.Embedded, which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this vulnerability by adding \"org.apache.commons.jelly.impl.Embedded\" to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.14.3 release before TuxCare onboarded it. The fix commit (77040d85e3) was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the FasterXML maintainer, and is an ancestor of the TuxCare onboarding commit. The vulnerable pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.14.3-tuxcare.1 contains the upstream fix that adds \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 192). This fix was already present in the upstream 2.14.3 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.14.3-tuxcare.1 contains the upstream fix that adds \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 192). This fix was already present in the upstream 2.14.3 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.14.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability (deserialization gadget via Oracle AQjms classes) has been mitigated by upstream commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e (authored by Tatu Saloranta, the upstream Jackson maintainer). All five Oracle AQjms classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the SubTypeValidator blocklist at lines 197-204, preventing their deserialization. This fix was part of the upstream 2.14.3 release that TuxCare onboarded, predating any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "Target jackson-databind 2.14.3 is NOT AFFECTED by CVE-2020-14061. The vulnerability (deserialization gadget via Oracle AQjms classes) has been mitigated by upstream commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e (authored by Tatu Saloranta, the upstream Jackson maintainer). All five Oracle AQjms classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the SubTypeValidator blocklist at lines 197-204, preventing their deserialization. This fix was part of the upstream 2.14.3 release that TuxCare onboarded, predating any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3 is not affected by CVE-2020-14062. The fix that adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist was already present in the upstream jackson-databind 2.14.3 release (commit 840eae2ca81c by Tatu Saloranta). The vulnerable deserialization gadget pattern is blocked at line 119 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "Target version 2.14.3 is not affected by CVE-2020-14062. The fix that adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist was already present in the upstream jackson-databind 2.14.3 release (commit 840eae2ca81c by Tatu Saloranta). The vulnerable deserialization gadget pattern is blocked at line 119 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 concerns jackson-databind's deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected because the fix was already present in the upstream 2.14.3 release that TuxCare onboarded. The fix (commit f6d9c664f6 from June 2020, authored by upstream maintainer tatu.saloranta@iki.fi) added org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blocklist in SubTypeValidator.java at line 207, preventing instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 concerns jackson-databind's deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected because the fix was already present in the upstream 2.14.3 release that TuxCare onboarded. The fix (commit f6d9c664f6 from June 2020, authored by upstream maintainer tatu.saloranta@iki.fi) added org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blocklist in SubTypeValidator.java at line 207, preventing instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:19:44.520074+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 concerns jackson-databind's polymorphic deserialization allowing the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class to be exploited for arbitrary code execution. The target repository (jackson-databind 2.14.3) contains the upstream fix at SubTypeValidator.java:147, which adds this class to a blocklist preventing its deserialization. The fix (commit 3d97153944) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.14.3 that TuxCare onboarded. The SubTypeValidator is actively invoked during bean deserialization via BeanDeserializerFactory, making the defense effective.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 concerns jackson-databind's polymorphic deserialization allowing the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class to be exploited for arbitrary code execution. The target repository (jackson-databind 2.14.3) contains the upstream fix at SubTypeValidator.java:147, which adds this class to a blocklist preventing its deserialization. The fix (commit 3d97153944) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.14.3 that TuxCare onboarded. The SubTypeValidator is actively invoked during bean deserialization via BeanDeserializerFactory, making the defense effective.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:02.250684+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.14.3. The vulnerable class com.pastdev.httpcomponents.configuration.JndiConfiguration is blacklisted in SubTypeValidator.java (line 210), preventing its deserialization. This fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit 6cc9f1a1af (July 2020) and was already present in the upstream 2.14.3 release when TuxCare onboarded it. The SubTypeValidator enforces the blacklist at runtime, throwing an error if a blacklisted class is encountered during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.14.3. The vulnerable class com.pastdev.httpcomponents.configuration.JndiConfiguration is blacklisted in SubTypeValidator.java (line 210), preventing its deserialization. This fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit 6cc9f1a1af (July 2020) and was already present in the upstream 2.14.3 release when TuxCare onboarded it. The SubTypeValidator enforces the blacklist at runtime, throwing an error if a blacklisted class is encountered during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.14.3. The upstream vendor (Tatu Saloranta) fixed this issue in commit 612f971b78 by adding two XML security features: disallow-doctype-decl=true and load-external-dtd=false. This fix was released in jackson-databind-2.11.0 (January 2020) and was already present when TuxCare onboarded version 2.14.3. The vulnerable pattern (XML parser without XXE protections) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.14.3. The upstream vendor (Tatu Saloranta) fixed this issue in commit 612f971b78 by adding two XML security features: disallow-doctype-decl=true and load-external-dtd=false. This fix was released in jackson-databind-2.11.0 (January 2020) and was already present when TuxCare onboarded version 2.14.3. The vulnerable pattern (XML parser without XXE protections) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:20:46.497840+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected by CVE-2020-35490. The vulnerability required adding org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was applied by upstream maintainer Tatu Saloranta in commit 41b8bdb5ccc on December 15, 2020, and was already present in the upstream 2.14.3 release before TuxCare onboarded it. The blocklist entries exist at lines 217-218 of SubTypeValidator.java, and the validation mechanism at lines 269-303 enforces the block, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected by CVE-2020-35490. The vulnerability required adding org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was applied by upstream maintainer Tatu Saloranta in commit 41b8bdb5ccc on December 15, 2020, and was already present in the upstream 2.14.3 release before TuxCare onboarded it. The blocklist entries exist at lines 217-218 of SubTypeValidator.java, and the validation mechanism at lines 269-303 enforces the block, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:35:45.229167+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is not present in jackson-databind 2.14.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already included in the upstream 2.14.3 release, before TuxCare's onboarding commit (0c8533d168). The target is not affected because the vulnerable pattern (missing blocklist entries) does not exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is not present in jackson-databind 2.14.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5ccc by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already included in the upstream 2.14.3 release, before TuxCare's onboarding commit (0c8533d168). The target is not affected because the vulnerable pattern (missing blocklist entries) does not exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:00.210651+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8. The target repository is jackson-databind 2.14.3-tuxcare.1, which already contains the upstream fix. The dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocklisted in SubTypeValidator.java at line 240, preventing JNDI injection attacks via polymorphic deserialization. The fix was committed upstream by Tatu Saloranta on 2020-12-26 (commit 1ca0388c2f) and shipped in the upstream 2.14.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8. The target repository is jackson-databind 2.14.3-tuxcare.1, which already contains the upstream fix. The dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocklisted in SubTypeValidator.java at line 240, preventing JNDI injection attacks via polymorphic deserialization. The fix was committed upstream by Tatu Saloranta on 2020-12-26 (commit 1ca0388c2f) and shipped in the upstream 2.14.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:14.873847+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 does NOT affect jackson-databind 2.14.3-tuxcare.1. The vulnerability was fixed in upstream version 2.9.10.8 (released January 2021) via commit 3ded28aece, which added the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related DBCP adapter classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.14.3 release (released January 2023) that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 does NOT affect jackson-databind 2.14.3-tuxcare.1. The vulnerability was fixed in upstream version 2.9.10.8 (released January 2021) via commit 3ded28aece, which added the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related DBCP adapter classes to the SubTypeValidator blocklist. This fix was already present in the upstream 2.14.3 release (released January 2023) that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected by CVE-2020-36180. The vulnerability involves deserialization of malicious gadget class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related variants that can lead to remote code execution. The upstream vendor fix (commit 3ded28aece) added all DriverAdapterCPDS variants to SubTypeValidator's blacklist, preventing their deserialization. This fix was already present in upstream release 2.14.3 (which TuxCare onboarded), authored by upstream maintainer Tatu Saloranta, not by TuxCare. The vulnerable pattern is not present in the target because the upstream fix removed it before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.3-tuxcare.1) is NOT affected by CVE-2020-36180. The vulnerability involves deserialization of malicious gadget class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related variants that can lead to remote code execution. The upstream vendor fix (commit 3ded28aece) added all DriverAdapterCPDS variants to SubTypeValidator's blacklist, preventing their deserialization. This fix was already present in upstream release 2.14.3 (which TuxCare onboarded), authored by upstream maintainer Tatu Saloranta, not by TuxCare. The vulnerable pattern is not present in the target because the upstream fix removed it before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:41:26.898836+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3 is not affected by CVE-2020-36181. The fix (commit 3ded28aece) was already included in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. The SubTypeValidator blocklist contains all DriverAdapterCPDS variants including org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS (line 228), preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "Target version 2.14.3 is not affected by CVE-2020-36181. The fix (commit 3ded28aece) was already included in the upstream jackson-databind 2.14.3 release that TuxCare onboarded. The SubTypeValidator blocklist contains all DriverAdapterCPDS variants including org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS (line 228), preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:30.909844+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is NOT present in jackson-databind 2.14.3. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding the dangerous class to a blocklist in SubTypeValidator.java. This fix was included in the upstream 2.14.3 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is NOT present in jackson-databind 2.14.3. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding the dangerous class to a blocklist in SubTypeValidator.java. This fix was included in the upstream 2.14.3 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:56.878680+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind version 2.14.3 is NOT vulnerable to CVE-2020-36183. The fix (blocking the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool from deserialization) is present in SubTypeValidator.java at line 243. This fix was authored by upstream maintainer Tatu Saloranta (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 on 2020-12-31) and was already included in the jackson-databind 2.14.3 release that TuxCare onboarded. The vulnerable deserialization pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "Target repository jackson-databind version 2.14.3 is NOT vulnerable to CVE-2020-36183. The fix (blocking the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool from deserialization) is present in SubTypeValidator.java at line 243. This fix was authored by upstream maintainer Tatu Saloranta (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 on 2020-12-31) and was already included in the jackson-databind 2.14.3 release that TuxCare onboarded. The vulnerable deserialization pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, which could enable JNDI injection attacks. The upstream fix (commit 567194c53a by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.14.3 before TuxCare onboarded it, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, which could enable JNDI injection attacks. The upstream fix (commit 567194c53a by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.14.3 before TuxCare onboarded it, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involved missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which allowed deserialization gadget attacks. The fix (adding these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java) was shipped in upstream version 2.9.10.8 (commit 567194c53a, Dec 2020) and is present in all subsequent releases including 2.14.3. The target repository contains the complete fix at lines 235-236 of SubTypeValidator.java, blocking deserialization of both gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability involved missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which allowed deserialization gadget attacks. The fix (adding these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java) was shipped in upstream version 2.9.10.8 (commit 567194c53a, Dec 2020) and is present in all subsequent releases including 2.14.3. The target repository contains the complete fix at lines 235-236 of SubTypeValidator.java, blocking deserialization of both gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:30:21.985032+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 targets jackson-databind's polymorphic deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes. The target (jackson-databind 2.14.3-tuxcare.1) is NOT AFFECTED because the upstream fix (commit 3e8fa3beea by Tatu Saloranta) was already present in version 2.14.3 when TuxCare onboarded it. The dangerous classes are blocked in SubTypeValidator.java lines 229-230, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 targets jackson-databind's polymorphic deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes. The target (jackson-databind 2.14.3-tuxcare.1) is NOT AFFECTED because the upstream fix (commit 3e8fa3beea by Tatu Saloranta) was already present in version 2.14.3 when TuxCare onboarded it. The dangerous classes are blocked in SubTypeValidator.java lines 229-230, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:44:46.412412+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.14.3-tuxcare.1 is not affected by CVE-2020-36187. The vulnerability involves Jackson allowing deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable JNDI injection attacks. The fix was already present in the upstream version 2.14.3 release that TuxCare onboarded. These classes are blacklisted in SubTypeValidator.java lines 229-230, with active enforcement preventing their deserialization. The upstream fix was authored by Tatu Saloranta on 2020-12-26 (commit 3e8fa3beea) and shipped 757 commits before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "Target version 2.14.3-tuxcare.1 is not affected by CVE-2020-36187. The vulnerability involves Jackson allowing deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) that enable JNDI injection attacks. The fix was already present in the upstream version 2.14.3 release that TuxCare onboarded. These classes are blacklisted in SubTypeValidator.java lines 229-230, with active enforcement preventing their deserialization. The upstream fix was authored by Tatu Saloranta on 2020-12-26 (commit 3e8fa3beea) and shipped 757 commits before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:50:34.321769+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8. The target version 2.14.3-tuxcare.1 contains the upstream fix that blocks deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.14.3 release before TuxCare's onboarding. The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8. The target version 2.14.3-tuxcare.1 contains the upstream fix that blocks deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.14.3 release before TuxCare's onboarding. The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.14.3-tuxcare.1. The fix was already included in the upstream jackson-databind 2.14.3 release (commit 33d96c13 by Tatu Saloranta, December 2020) before TuxCare onboarded this version. The vulnerable deserialization gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blocked in SubTypeValidator.java lines 221-224.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.14.3-tuxcare.1. The fix was already included in the upstream jackson-databind 2.14.3 release (commit 33d96c13 by Tatu Saloranta, December 2020) before TuxCare onboarded this version. The vulnerable deserialization gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blocked in SubTypeValidator.java lines 221-224.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:16:00.456035+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.3-tuxcare.1) is not affected by CVE-2020-36518 (stack overflow via deeply nested JSON). The vulnerable recursive deserialization code has been replaced by a non-recursive implementation (UntypedObjectDeserializerNR) that uses heap-allocated Scope objects to track nesting instead of stack frames, eliminating the stack overflow vulnerability entirely. This fix was authored by upstream maintainer Tatu Saloranta (commit 8238ab41d0) and shipped in the upstream 2.14.3 release that TuxCare onboarded. The fix is wired up at UntypedObjectDeserializer.java line 199, and the deprecated Vanilla class (which contained the vulnerable recursive implementation) has zero production code references.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.3-tuxcare.1) is not affected by CVE-2020-36518 (stack overflow via deeply nested JSON). The vulnerable recursive deserialization code has been replaced by a non-recursive implementation (UntypedObjectDeserializerNR) that uses heap-allocated Scope objects to track nesting instead of stack frames, eliminating the stack overflow vulnerability entirely. This fix was authored by upstream maintainer Tatu Saloranta (commit 8238ab41d0) and shipped in the upstream 2.14.3 release that TuxCare onboarded. The fix is wired up at UntypedObjectDeserializer.java line 199, and the deprecated Vanilla class (which contained the vulnerable recursive implementation) has zero production code references.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:10:12.627525+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3-tuxcare.1 is NOT AFFECTED by CVE-2020-8840. The vulnerability requires the ability to deserialize the gadget class org.apache.xbean.propertyeditor.JndiConverter to achieve code execution through JNDI lookup. The upstream version 2.14.3 already contains the fix (commit 9bb52c7122) that adds this class to the deserialization blocklist in SubTypeValidator.java (line 138), preventing the attack. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.14.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind 2.14.3-tuxcare.1 is NOT AFFECTED by CVE-2020-8840. The vulnerability requires the ability to deserialize the gadget class org.apache.xbean.propertyeditor.JndiConverter to achieve code execution through JNDI lookup. The upstream version 2.14.3 already contains the fix (commit 9bb52c7122) that adds this class to the deserialization blocklist in SubTypeValidator.java (line 138), preventing the attack. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.14.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3 is not affected by CVE-2020-9546. The vulnerability involves deserialization of the org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig gadget class. The fix (adding this class to the SubTypeValidator blocklist) was included in upstream jackson-databind 2.14.3 release, committed by upstream maintainer Tatu Saloranta on 2020-03-10. The CVE states versions \"before 2.9.10.4\" are affected; version 2.14.3 (released years later) already contains the fix. The blocklist entry is present at SubTypeValidator.java:141 and is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target jackson-databind 2.14.3 is not affected by CVE-2020-9546. The vulnerability involves deserialization of the org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig gadget class. The fix (adding this class to the SubTypeValidator blocklist) was included in upstream jackson-databind 2.14.3 release, committed by upstream maintainer Tatu Saloranta on 2020-03-10. The CVE states versions \"before 2.9.10.4\" are affected; version 2.14.3 (released years later) already contains the fix. The blocklist entry is present at SubTypeValidator.java:141 and is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:43.036497+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.3-tuxcare.1 is NOT affected by CVE-2020-9547. The vulnerability involves deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) is present in the target at line 144. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.14.3, which TuxCare onboarded. The vulnerable pattern is not present because the upstream fix was already included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "The target jackson-databind 2.14.3-tuxcare.1 is NOT affected by CVE-2020-9547. The vulnerability involves deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) is present in the target at line 144. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.14.3, which TuxCare onboarded. The vulnerable pattern is not present because the upstream fix was already included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.14.3 is not affected by CVE-2020-9548. The vulnerability involves deserialization gadgets including br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by tatu.saloranta@iki.fi, dated 2020-02-29) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream version 2.14.3 before TuxCare onboarded it on 2026-09-10. The vulnerable pattern is not present in the target because the upstream vendor shipped the fix in versions 2.7.9.7, 2.8.11.6, and 2.9.10.4, all of which predate version 2.14.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "The target repository jackson-databind version 2.14.3 is not affected by CVE-2020-9548. The vulnerability involves deserialization gadgets including br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by tatu.saloranta@iki.fi, dated 2020-02-29) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream version 2.14.3 before TuxCare onboarded it on 2026-09-10. The vulnerable pattern is not present in the target because the upstream vendor shipped the fix in versions 2.7.9.7, 2.8.11.6, and 2.9.10.4, all of which predate version 2.14.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:46.829367+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7, concerning deserialization gadgets. The target version 2.14.3-tuxcare.1 already contains the upstream fix from commit 7dbf51bf78 (authored by Tatu Saloranta), which added multiple gadget classes (javax.swing.JTextPane, org.springframework.aop.config.MethodLocatingFactoryBean, various ActiveMQ, Shiro, and other classes) to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded (commit 0c8533d168), not applied as a separate TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7, concerning deserialization gadgets. The target version 2.14.3-tuxcare.1 already contains the upstream fix from commit 7dbf51bf78 (authored by Tatu Saloranta), which added multiple gadget classes (javax.swing.JTextPane, org.springframework.aop.config.MethodLocatingFactoryBean, various ActiveMQ, Shiro, and other classes) to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.14.3 release that TuxCare onboarded (commit 0c8533d168), not applied as a separate TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability (DoS via 2GB heap allocation from untrusted JDK serialization length field) was fixed in upstream commit 3ccde7d938fe by Tatu Saloranta, which shipped in the upstream 2.14.3 release. The fix was already present when TuxCare onboarded version 2.14.3 (onboarding commit 0c8533d168 by amoniatovskiy@cloudlinux.com). The target contains the complete mitigation: NodeSerialization.java implements LONGEST_EAGER_ALLOC (100KB cap) and chunked reading via _read() method to prevent excessive heap allocation from attacker-controlled length declarations. No alternative vulnerable code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 is NOT present in jackson-databind 2.14.3-tuxcare.1. The vulnerability (DoS via 2GB heap allocation from untrusted JDK serialization length field) was fixed in upstream commit 3ccde7d938fe by Tatu Saloranta, which shipped in the upstream 2.14.3 release. The fix was already present when TuxCare onboarded version 2.14.3 (onboarding commit 0c8533d168 by amoniatovskiy@cloudlinux.com). The target contains the complete mitigation: NodeSerialization.java implements LONGEST_EAGER_ALLOC (100KB cap) and chunked reading via _read() method to prevent excessive heap allocation from attacker-controlled length declarations. No alternative vulnerable code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:24.708688+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 affects jackson-databind versions before 2.14.0 due to resource exhaustion from deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.14.3 is NOT vulnerable because the upstream fix (commits d78d00ee7b and 0631835892 by Tatu Saloranta) was already included in the upstream 2.14.0 release and is present in the onboarded 2.14.3 code. All primitive deserializers, date deserializer, and BeanDeserializer contain the handleNestedArrayForSingle protection that prevents deep array nesting exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 affects jackson-databind versions before 2.14.0 due to resource exhaustion from deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.14.3 is NOT vulnerable because the upstream fix (commits d78d00ee7b and 0631835892 by Tatu Saloranta) was already included in the upstream 2.14.0 release and is present in the onboarded 2.14.3 code. All primitive deserializers, date deserializer, and BeanDeserializer contain the handleNestedArrayForSingle protection that prevents deep array nesting exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:57:36.079339+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.14.3 is NOT vulnerable to CVE-2022-42004. The fix for this vulnerability was already present in the upstream 2.14.3 release before TuxCare onboarded it. The vulnerable pattern (missing check for deeply nested arrays in BeanDeserializer._deserializeFromArray) has been removed by upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 authored by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "The target jackson-databind version 2.14.3 is NOT vulnerable to CVE-2022-42004. The fix for this vulnerability was already present in the upstream 2.14.3 release before TuxCare onboarded it. The vulnerable pattern (missing check for deeply nested arrays in BeanDeserializer._deserializeFromArray) has been removed by upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 authored by Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:17:50.706643+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 (Denial-of-Service via deeply nested JSON causing StackOverflowError in JsonNode.toString()) is NOT present in jackson-databind 2.14.3. The vulnerability was fixed in upstream version 2.14.0 via commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by Tatu Saloranta. The fix replaced recursive serialization with iterative serialization using a heap-based IteratorStack, preventing call-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 (Denial-of-Service via deeply nested JSON causing StackOverflowError in JsonNode.toString()) is NOT present in jackson-databind 2.14.3. The vulnerability was fixed in upstream version 2.14.0 via commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by Tatu Saloranta. The fix replaced recursive serialization with iterative serialization using a heap-based IteratorStack, preventing call-..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:31:13.178868+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.14.3 is not affected by CVE-2026-54517. The vulnerability was introduced by issue #5237 (August 2025), which added `isMerging()` support for mergeable properties in property-based creator deserialization paths. This change occurred more than 2 years after version 2.14.3 was released (May 2023). The vulnerable code path - where setterless properties with restricted `@JsonView` annotati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.14.3 is not affected by CVE-2026-54517. The vulnerability was introduced by issue #5237 (August 2025), which added `isMerging()` support for mergeable properties in property-based creator deserialization paths. This change occurred more than 2 years after version 2.14.3 was released (May 2023). The vulnerable code path - where setterless properties with restricted `@JsonView` annotati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:03:28.453734+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.14.3 is not affected by CVE-2026-54518. The vulnerability requires the @JsonUnwrapped + @JsonCreator feature combination, which was introduced in version 2.19.0 (commit 502fe888da, 1265 commits after 2.14.2). Version 2.14.3 explicitly rejects this combination with an exception: \"Cannot define Creator parameter as `@JsonUnwrapped`: combination not yet supported\" (BasicDeserializerFacto...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.14.3 is not affected by CVE-2026-54518. The vulnerability requires the @JsonUnwrapped + @JsonCreator feature combination, which was introduced in version 2.19.0 (commit 502fe888da, 1265 commits after 2.14.2). Version 2.14.3 explicitly rejects this combination with an exception: \"Cannot define Creator parameter as `@JsonUnwrapped`: combination not yet supported\" (BasicDeserializerFacto..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:08:47.794831+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:08:23.581367+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:08:23.581367+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:08:23.581367+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:08:23.581367+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.3-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:21:28.696662+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.14.3-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}