{
  "@id": "urn:uuid:f85959e9-f951-4cfe-a982-f953299945bd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 65,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:17:00.447062+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is a deserialization vulnerability allowing code execution via polymorphic deserialization of dangerous classes. The fix blacklists additional classes including java.util.logging.FileHandler and java.rmi.server.UnicastRemoteObject. The target repository (jackson-databind 2.15.1-tuxcare.3) contains this fix in SubTypeValidator.java lines 47-48. The fix was authored by upstream maintainer tatu.saloranta@iki.fi in commit ddfddfba64 (2017-08-17) and was already present in the upstream 2.15.1 release that TuxCare onboarded. The blacklist is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is a deserialization vulnerability allowing code execution via polymorphic deserialization of dangerous classes. The fix blacklists additional classes including java.util.logging.FileHandler and java.rmi.server.UnicastRemoteObject. The target repository (jackson-databind 2.15.1-tuxcare.3) contains this fix in SubTypeValidator.java lines 47-48. The fix was authored by upstream maintainer tatu.saloranta@iki.fi in commit ddfddfba64 (2017-08-17) and was already present in the upstream 2.15.1 release that TuxCare onboarded. The blacklist is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 addresses incomplete blacklist fixes for polymorphic deserialization gadgets in jackson-databind. The upstream fix (commit 2235894210, databind#1855) created SubTypeValidator.java with blacklist entries for dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and Spring framework class hierarchy checks for AbstractPointcutAdvisor/AbstractApplicationContext. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream jackson-databind 2.15.1 before TuxCare onboarded the version. Target version 2.15.1-tuxcare.3 at SHA ae0c0d822840 contains the complete fix as verified in SubTypeValidator.java lines 47-60 and 278-287.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 addresses incomplete blacklist fixes for polymorphic deserialization gadgets in jackson-databind. The upstream fix (commit 2235894210, databind#1855) created SubTypeValidator.java with blacklist entries for dangerous classes including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and Spring framework class hierarchy checks for AbstractPointcutAdvisor/AbstractApplicationContext. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream jackson-databind 2.15.1 before TuxCare onboarded the version. Target version 2.15.1-tuxcare.3 at SHA ae0c0d822840 contains the complete fix as verified in SubTypeValidator.java lines 47-60 and 278-287.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:29:38.548798+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.15.1-tuxcare.3 is significantly newer and contains upstream fixes that were already present in the upstream release before TuxCare onboarded the project. The vulnerability allowed arbitrary code execution via deserialization of malicious gadget classes. The fix adds validation through SubTypeValidator class that blocks deserialization of known dangerous classes including TemplatesImpl, InvokerTransformer, and others. This protection was introduced by upstream author Tatu Saloranta in 2017 and is fully present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.15.1-tuxcare.3 is significantly newer and contains upstream fixes that were already present in the upstream release before TuxCare onboarded the project. The vulnerability allowed arbitrary code execution via deserialization of malicious gadget classes. The fix adds validation through SubTypeValidator class that blocks deserialization of known dangerous classes including TemplatesImpl, InvokerTransformer, and others. This protection was introduced by upstream author Tatu Saloranta in 2017 and is fully present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:21:23.269302+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5 and involves deserialization of the iBatis XPathParser gadget class leading to data exfiltration. The target version 2.15.1 is NOT AFFECTED because the upstream fix (adding org.apache.ibatis.parsing.XPathParser to the SubTypeValidator blacklist) was already present in version 2.15.1 when TuxCare onboarded it. The fix commit 27b4defc27 by upstream maintainer Tatu Saloranta was applied on May 10, 2018, and shipped in the upstream release. The vulnerable pattern (unrestricted deserialization of XPathParser) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5 and involves deserialization of the iBatis XPathParser gadget class leading to data exfiltration. The target version 2.15.1 is NOT AFFECTED because the upstream fix (adding org.apache.ibatis.parsing.XPathParser to the SubTypeValidator blacklist) was already present in version 2.15.1 when TuxCare onboarded it. The fix commit 27b4defc27 by upstream maintainer Tatu Saloranta was applied on May 10, 2018, and shipped in the upstream release. The vulnerable pattern (unrestricted deserialization of XPathParser) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:10.514084+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.15.1. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.15.1 already contains the upstream fix that adds blocklist entries for dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to SubTypeValidator.java. This fix was shipped in upstream release 2.7.9.4 (June 2018) and was included when TuxCare onboarded version 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.15.1. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.15.1 already contains the upstream fix that adds blocklist entries for dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to SubTypeValidator.java. This fix was shipped in upstream release 2.7.9.4 (June 2018) and was included when TuxCare onboarded version 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:21:53.187202+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing arbitrary code execution via Oracle JDBC deserialization gadgets when Default Typing is enabled. The target (jackson-databind 2.15.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.15.1 that TuxCare onboarded. The Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are blacklisted in SubTypeValidator.java at lines 70-72, preventing their deserialization during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing arbitrary code execution via Oracle JDBC deserialization gadgets when Default Typing is enabled. The target (jackson-databind 2.15.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.15.1 that TuxCare onboarded. The Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are blacklisted in SubTypeValidator.java at lines 70-72, preventing their deserialization during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:57:09.327261+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT AFFECTED in jackson-databind 2.15.1-tuxcare.3. The vulnerability required blocking org.slf4j.ext.EventData from polymorphic deserialization to prevent remote code execution. This fix was applied by upstream FasterXML in commit 87d29af25e (authored by Tatu Saloranta) and was already present in the upstream 2.15.1 release when TuxCare onboarded it. The blocklist entry exists in SubTypeValidator.java line 75 and is actively enforced by default during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT AFFECTED in jackson-databind 2.15.1-tuxcare.3. The vulnerability required blocking org.slf4j.ext.EventData from polymorphic deserialization to prevent remote code execution. This fix was applied by upstream FasterXML in commit 87d29af25e (authored by Tatu Saloranta) and was already present in the upstream 2.15.1 release when TuxCare onboarded it. The blocklist entry exists in SubTypeValidator.java line 75 and is actively enforced by default during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.15.1-tuxcare.3. The fix for this polymorphic deserialization vulnerability was already included in the upstream release 2.15.1. The target repository contains the complete blacklist defense that blocks all four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from being deserialized. This blacklist is actively enforced during bean deserialization via SubTypeValidator, preventing the arbitrary code execution attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.15.1-tuxcare.3. The fix for this polymorphic deserialization vulnerability was already included in the upstream release 2.15.1. The target repository contains the complete blacklist defense that blocks all four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from being deserialized. This blacklist is actively enforced during bean deserialization via SubTypeValidator, preventing the arbitrary code execution attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:08:55.717276+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2018-14720. The fix that blocks four dangerous classes from polymorphic deserialization (preventing XXE and code execution attacks) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 and was already present in upstream version 2.15.1 when TuxCare onboarded it. The four classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are confirmed blocked in SubTypeValidator.java and the validation is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2018-14720. The fix that blocks four dangerous classes from polymorphic deserialization (preventing XXE and code execution attacks) was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 and was already present in upstream version 2.15.1 when TuxCare onboarded it. The four classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are confirmed blocked in SubTypeValidator.java and the validation is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:39:42.552241+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.15.1. The vulnerability involves polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl leading to SSRF. The upstream fix (commit 87d29af25e by Tatu Saloranta, Aug 2018) added this class to the deserialization blocklist in SubTypeValidator.java line 78. This fix was already present in the upstream 2.15.1 release when TuxCare onboarded it (first TuxCare commit aa2ac299b6). The blocklist is actively enforced via SubTypeValidator.instance().validateSubType() called during deserialization in BeanDeserializerFactory.java line 1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.15.1. The vulnerability involves polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl leading to SSRF. The upstream fix (commit 87d29af25e by Tatu Saloranta, Aug 2018) added this class to the deserialization blocklist in SubTypeValidator.java line 78. This fix was already present in the upstream 2.15.1 release when TuxCare onboarded it (first TuxCare commit aa2ac299b6). The blocklist is actively enforced via SubTypeValidator.instance().validateSubType() called during deserialization in BeanDeserializerFactory.java line 1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:09.053481+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo, which can enable attackers to execute unintended operations. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected because the fix was already present in the upstream 2.15.1 release. The blacklist entry for this class exists at line 85 of SubTypeValidator.java and is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo, which can enable attackers to execute unintended operations. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected because the fix was already present in the upstream 2.15.1 release. The blacklist entry for this class exists at line 85 of SubTypeValidator.java and is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:58:10.565756+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability (failure to block openjpa classes from polymorphic deserialization) was fixed in upstream commit 72cd4025a2 by Tatu Saloranta, which was included in the upstream 2.15.1 release that TuxCare onboarded. The SubTypeValidator blocklist at lines 82-83 now contains org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime, preventing these dangerous classes from being deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability (failure to block openjpa classes from polymorphic deserialization) was fixed in upstream commit 72cd4025a2 by Tatu Saloranta, which was included in the upstream 2.15.1 release that TuxCare onboarded. The SubTypeValidator blocklist at lines 82-83 now contains org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime, preventing these dangerous classes from being deserialized.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:10.977883+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind 2.x before 2.9.8, concerning polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The target repository (jackson-databind 2.15.1-tuxcare.3) already contains the upstream vendor fix that adds this class to the deserialization blocklist in SubTypeValidator.java at line 81. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a22 (2018-11-19) and was already present in the upstream 2.15.1 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind 2.x before 2.9.8, concerning polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The target repository (jackson-databind 2.15.1-tuxcare.3) already contains the upstream vendor fix that adds this class to the deserialization blocklist in SubTypeValidator.java at line 81. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a22 (2018-11-19) and was already present in the upstream 2.15.1 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.15.1-tuxcare.3. The fix (adding org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist) was already included in the upstream jackson-databind 2.15.1 release, authored by Tatu Saloranta. The vulnerable pattern (missing blacklist entries for these two gadget classes) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.15.1-tuxcare.3. The fix (adding org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist) was already included in the upstream jackson-databind 2.15.1 release, authored by Tatu Saloranta. The vulnerable pattern (missing blacklist entries for these two gadget classes) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:54:41.040148+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involved an incomplete blacklist for c3p0 deserialization gadgets, allowing remote code execution via maliciously crafted JSON with default typing enabled. The fix (blocking all c3p0 classes matching pattern com.mchange.v2.c3p0.*DataSource) was applied by upstream maintainer Tatu Saloranta in commit 6799f8f10c and shipped in the upstream 2.15.1 release before TuxCare onboarding. The defense code is present at SubTypeValidator.java:288-298 and actively blocks c3p0 DataSource deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involved an incomplete blacklist for c3p0 deserialization gadgets, allowing remote code execution via maliciously crafted JSON with default typing enabled. The fix (blocking all c3p0 classes matching pattern com.mchange.v2.c3p0.*DataSource) was applied by upstream maintainer Tatu Saloranta in commit 6799f8f10c and shipped in the upstream 2.15.1 release before TuxCare onboarding. The defense code is present at SubTypeValidator.java:288-298 and actively blocks c3p0 DataSource deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:35:21.882986+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.15.1 is not affected by CVE-2019-12086. The vulnerability required the ability to deserialize the gadget class com.mysql.cj.jdbc.admin.MiniAdmin via polymorphic typing, which could enable arbitrary file disclosure. The fix (adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java) was introduced by upstream FasterXML in version 2.9.9 (May 2019) and is present in version 2.15.1. The fix commit by Tatu Saloranta (tatu.saloranta@iki.fi) was already in the upstream release before TuxCare onboarded version 2.15.1, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "Target jackson-databind version 2.15.1 is not affected by CVE-2019-12086. The vulnerability required the ability to deserialize the gadget class com.mysql.cj.jdbc.admin.MiniAdmin via polymorphic typing, which could enable arbitrary file disclosure. The fix (adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java) was introduced by upstream FasterXML in version 2.9.9 (May 2019) and is present in version 2.15.1. The fix commit by Tatu Saloranta (tatu.saloranta@iki.fi) was already in the upstream release before TuxCare onboarded version 2.15.1, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T18:40:04.693122+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involved missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization, allowing potential RCE. The fix was authored by upstream maintainer Tatu Saloranta (commit c9ef4a10d6f) and was already present in upstream version 2.15.1 when TuxCare onboarded it (commit ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involved missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization, allowing potential RCE. The fix was authored by upstream maintainer Tatu Saloranta (commit c9ef4a10d6f) and was already present in upstream version 2.15.1 when TuxCare onboarded it (commit ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T07:22:00.114320+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 via polymorphic deserialization of JDOM XSLTransformer classes leading to arbitrary file read. The target version 2.15.1-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 5f7c69bba0, June 2019) was already included in upstream version 2.15.1 when TuxCare onboarded it in September 2026. The fix adds org.jdom.transform.XSLTransfor...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 via polymorphic deserialization of JDOM XSLTransformer classes leading to arbitrary file read. The target version 2.15.1-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 5f7c69bba0, June 2019) was already included in upstream version 2.15.1 when TuxCare onboarded it in September 2026. The fix adds org.jdom.transform.XSLTransfor..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:14:20.152420+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.1 is NOT AFFECTED by CVE-2019-14379. The vulnerability (unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup leading to RCE) was fixed by upstream maintainer Tatu Saloranta on 2019-07-25 in commit ad418eeb97. This fix was already present in jackson-databind 2.15.1 when TuxCare onboarded the version on 2026-09-20. The dangerous class is blocked in SubTypeValidator.java line 98, and this validation is invoked in the core deserialization path (BeanDeserializerFactory.java:141) with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target jackson-databind 2.15.1 is NOT AFFECTED by CVE-2019-14379. The vulnerability (unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup leading to RCE) was fixed by upstream maintainer Tatu Saloranta on 2019-07-25 in commit ad418eeb97. This fix was already present in jackson-databind 2.15.1 when TuxCare onboarded the version on 2026-09-20. The dangerous class is blocked in SubTypeValidator.java line 98, and this validation is invoked in the core deserialization path (BeanDeserializerFactory.java:141) with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled, allowing RCE via JNDI injection through deserialization of ch.qos.logback.core.db.JNDIConnectionSource. The target repository (jackson-databind 2.15.1-tuxcare.3 at commit ae0c0d8228) contains the upstream fix that adds this class to the SubTypeValidator blacklist. The fix was authored by upstream maintainer Tatu Saloranta (commit ad418eeb97) and shipped in the upstream 2.15.1 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled, allowing RCE via JNDI injection through deserialization of ch.qos.logback.core.db.JNDIConnectionSource. The target repository (jackson-databind 2.15.1-tuxcare.3 at commit ae0c0d8228) contains the upstream fix that adds this class to the SubTypeValidator blacklist. The fix was authored by upstream maintainer Tatu Saloranta (commit ad418eeb97) and shipped in the upstream 2.15.1 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.15.1-tuxcare.3 is significantly newer and already includes the upstream fix. The vulnerable pattern (unrestricted deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource) has been mitigated by upstream maintainer Tatu Saloranta, who added these classes to the deserialization blacklist in SubTypeValidator.java in August-September 2019. These fixes were included in the upstream jackson-databind 2.15.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. The target version 2.15.1-tuxcare.3 is significantly newer and already includes the upstream fix. The vulnerable pattern (unrestricted deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource) has been mitigated by upstream maintainer Tatu Saloranta, who added these classes to the deserialization blacklist in SubTypeValidator.java in August-September 2019. These fixes were included in the upstream jackson-databind 2.15.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:36.777269+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code. The fix (adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist) was already included in the upstream release 2.15.1 that TuxCare onboarded. The blocklist entries exist at lines 112-114 of SubTypeValidator.java, preventing these classes from being deserialized. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to execute arbitrary code. The fix (adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the deserialization blocklist) was already included in the upstream release 2.15.1 that TuxCare onboarded. The blocklist entries exist at lines 112-114 of SubTypeValidator.java, preventing these classes from being deserialized. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10/2.10.0, allowing polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) to achieve arbitrary code execution. The target version 2.15.1 is not affected because the fix was already present in the upstream release. The dangerous class is blocked in SubTypeValidator.java line 117, added by upstream commit 998efd708 (authored by Tatu Saloranta on 2019-09-19). This fix was part of the upstream 2.15.1 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10/2.10.0, allowing polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) to achieve arbitrary code execution. The target version 2.15.1 is not affected because the fix was already present in the upstream release. The dangerous class is blocked in SubTypeValidator.java line 117, added by upstream commit 998efd708 (authored by Tatu Saloranta on 2019-09-19). This fix was part of the upstream 2.15.1 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:57.029053+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.1 is not affected by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, allowing potential code execution. The upstream vendor (FasterXML) fixed this in September 2019 by adding HikariDataSource to the SubTypeValidator blocklist (commit 73c1c2cc76). This fix was already present in upstream release 2.15.1 when TuxCare onboarded it in September 2026. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3 - all much older than 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "Target version 2.15.1 is not affected by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, allowing potential code execution. The upstream vendor (FasterXML) fixed this in September 2019 by adding HikariDataSource to the SubTypeValidator blocklist (commit 73c1c2cc76). This fix was already present in upstream release 2.15.1 when TuxCare onboarded it in September 2026. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3 - all much older than 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind versions 2.0.0 through 2.9.10. The target version 2.15.1-tuxcare.3 is significantly newer and already contains the upstream fix. The vulnerability involved polymorphic deserialization of dangerous commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) and p6spy classes (P6DataSource). The fix adds these classes to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java to prevent their deserialization. All three blocked class names from the upstream patches are present in the target at lines 124-127 of SubTypeValidator.java. The fix was authored by the upstream maintainer (Tatu Saloranta, tatu.saloranta@iki.fi) in September 2019 and shipped in upstream release 2.9.10.1+. When TuxCare onboarded version 2.15.1 via commit aa2ac299b6, the fix was already present. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind versions 2.0.0 through 2.9.10. The target version 2.15.1-tuxcare.3 is significantly newer and already contains the upstream fix. The vulnerability involved polymorphic deserialization of dangerous commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) and p6spy classes (P6DataSource). The fix adds these classes to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java to prevent their deserialization. All three blocked class names from the upstream patches are present in the target at lines 124-127 of SubTypeValidator.java. The fix was authored by the upstream maintainer (Tatu Saloranta, tatu.saloranta@iki.fi) in September 2019 and shipped in upstream release 2.9.10.1+. When TuxCare onboarded version 2.15.1 via commit aa2ac299b6, the fix was already present. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:17:09.184138+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target repository is jackson-databind version 2.15.1-tuxcare.3, which is significantly newer than the affected versions. The upstream fix (adding P6DataSource, PerUserPoolDataSource, and SharedPoolDataSource to the deserialization blacklist) was applied by upstream maintainer Tatu Saloranta in commit 9593e16cf5 (September 2019) and shipped in jackson-databind 2.9.10.1. This fix was already present in the upstream release 2.15.1 that TuxCare onboarded, so the vulnerable code pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target repository is jackson-databind version 2.15.1-tuxcare.3, which is significantly newer than the affected versions. The upstream fix (adding P6DataSource, PerUserPoolDataSource, and SharedPoolDataSource to the deserialization blacklist) was applied by upstream maintainer Tatu Saloranta in commit 9593e16cf5 (September 2019) and shipped in jackson-databind 2.9.10.1. This fix was already present in the upstream release 2.15.1 that TuxCare onboarded, so the vulnerable code pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:13.587550+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the gadget class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. The fix (adding this class to the deserialization blacklist) was committed by upstream author Tatu Saloranta on 2019-09-19 (commit 191a4cdf) and was already present in the upstream 2.15.1 release when TuxCare onboarded it on 2026-09-20. The blacklist entry exists at line 99 of SubTypeValidator.java, preventing instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the gadget class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. The fix (adding this class to the deserialization blacklist) was committed by upstream author Tatu Saloranta on 2019-09-19 (commit 191a4cdf) and was already present in the upstream 2.15.1 release when TuxCare onboarded it on 2026-09-20. The blacklist entry exists at line 99 of SubTypeValidator.java, preventing instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:19.112170+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath, allowing attackers to execute malicious payloads via JNDI lookups. The target repository (jackson-databind 2.15.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.15.1 release that TuxCare onboarded. The fix blocklists the two vulnerable log4j classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) in SubTypeValidator.java at lines 129-131, preventing their instantiation during deserialization. Fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (aa2ac299b6e431e5dd76e2bd18d9a589958b7f1e \"Onboard version 2.15.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath, allowing attackers to execute malicious payloads via JNDI lookups. The target repository (jackson-databind 2.15.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream 2.15.1 release that TuxCare onboarded. The fix blocklists the two vulnerable log4j classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) in SubTypeValidator.java at lines 129-131, preventing their instantiation during deserialization. Fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (aa2ac299b6e431e5dd76e2bd18d9a589958b7f1e \"Onboard version 2.15.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected by CVE-2019-20330. The vulnerability requires blocking deserialization of specific net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) to prevent JNDI injection attacks. This fix was already present in the upstream 2.15.1 release before TuxCare onboarded it, as confirmed by git ancestry analysis showing the fix commits (eb254813cc, fc4214a883) are ancestors of the first TuxCare commit and were authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected by CVE-2019-20330. The vulnerability requires blocking deserialization of specific net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) to prevent JNDI injection attacks. This fix was already present in the upstream 2.15.1 release before TuxCare onboarded it, as confirmed by git ancestry analysis showing the fix commits (eb254813cc, fc4214a883) are ancestors of the first TuxCare commit and were authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:04:40.164782+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability allows unsafe deserialization of dangerous ignite-jta and quartz-core classes through Jackson's polymorphic type handling. The fix (adding three class names to SubTypeValidator's deny-list) was already present in upstream version 2.15.1 before TuxCare onboarded it. The blocklist entries at SubTypeValidator.java:157-160 prevent instantiation of org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider during deserialization, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability allows unsafe deserialization of dangerous ignite-jta and quartz-core classes through Jackson's polymorphic type handling. The fix (adding three class names to SubTypeValidator's deny-list) was already present in upstream version 2.15.1 before TuxCare onboarded it. The blocklist entries at SubTypeValidator.java:157-160 prevent instantiation of org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider during deserialization, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability relates to deserialization gadgets (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory) that were blocked by upstream in commit 592872f423 on March 15, 2020. This fix was already present in the upstream 2.15.1 release when TuxCare onboarded it. The target repository contains the complete blocklist at SubTypeValidator.java lines 162-164, and the validation is actively enforced in the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability relates to deserialization gadgets (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory) that were blocked by upstream in commit 592872f423 on March 15, 2020. This fix was already present in the upstream 2.15.1 release when TuxCare onboarded it. The target repository contains the complete blocklist at SubTypeValidator.java lines 162-164, and the validation is actively enforced in the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.1-tuxcare.3 is NOT affected by CVE-2020-10673. The vulnerability involves unsafe deserialization of the gadget class com.caucho.config.types.ResourceRef. The fix, which adds this class to the deserialization blocklist in SubTypeValidator.java, was already present in the upstream version 2.15.1 before TuxCare onboarding. The fix commit 1645efbd392989cf015f459a91c999e59c921b15 by upstream author Tatu Saloranta is an ancestor of the first TuxCare commit aa2ac299b6e431e5dd76e2bd18d9a589958b7f1e (\"Onboard version 2.15.1\"), confirming the vulnerable code pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target repository jackson-databind version 2.15.1-tuxcare.3 is NOT affected by CVE-2020-10673. The vulnerability involves unsafe deserialization of the gadget class com.caucho.config.types.ResourceRef. The fix, which adds this class to the deserialization blocklist in SubTypeValidator.java, was already present in the upstream version 2.15.1 before TuxCare onboarding. The fix commit 1645efbd392989cf015f459a91c999e59c921b15 by upstream author Tatu Saloranta is an ancestor of the first TuxCare commit aa2ac299b6e431e5dd76e2bd18d9a589958b7f1e (\"Onboard version 2.15.1\"), confirming the vulnerable code pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2020-10968. The vulnerability affects versions before 2.9.10.4, and the fix was already present in the upstream 2.15.1 release. SubTypeValidator.java (lines 169-171) contains the blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider, preventing deserialization of these gadget classes. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "Target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2020-10968. The vulnerability affects versions before 2.9.10.4, and the fix was already present in the upstream 2.15.1 release. SubTypeValidator.java (lines 169-171) contains the blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider, preventing deserialization of these gadget classes. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 does not affect jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadget exploitation via javax.swing.JEditorPane. The fix (blocking JEditorPane from deserialization by adding it to the SubTypeValidator blocklist) was included in the upstream 2.15.1 release and is present in the target at SubTypeValidator.java:150. The CVE affects \"2.x before 2.9.10.4\" and version 2.15.1 includes the upstream fix from commit 6ba48457984943df0de92c54144f7dcae01b1221 by tatu.saloranta@iki.fi, which predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 does not affect jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadget exploitation via javax.swing.JEditorPane. The fix (blocking JEditorPane from deserialization by adding it to the SubTypeValidator blocklist) was included in the upstream 2.15.1 release and is present in the target at SubTypeValidator.java:150. The CVE affects \"2.x before 2.9.10.4\" and version 2.15.1 includes the upstream fix from commit 6ba48457984943df0de92c54144f7dcae01b1221 by tatu.saloranta@iki.fi, which predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.1-tuxcare.3 is NOT vulnerable to CVE-2020-11111. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The upstream fix adds these classes to a blacklist in SubTypeValidator.java, preventing their deserialization. This fix (commit c14c9f99ed) was committed by upstream maintainer Tatu Saloranta in March 2020 and shipped in upstream version 2.9.10.4 (April 2020). Version 2.15.1 (May 2023) is 3 years newer and includes the fix. The blacklist entries are present at lines 175-183 of SubTypeValidator.java, and the validation mechanism at line 269 blocks deserialization attempts with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target jackson-databind version 2.15.1-tuxcare.3 is NOT vulnerable to CVE-2020-11111. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The upstream fix adds these classes to a blacklist in SubTypeValidator.java, preventing their deserialization. This fix (commit c14c9f99ed) was committed by upstream maintainer Tatu Saloranta in March 2020 and shipped in upstream version 2.9.10.4 (April 2020). Version 2.15.1 (May 2023) is 3 years newer and includes the fix. The blacklist entries are present at lines 175-183 of SubTypeValidator.java, and the validation mechanism at line 269 blocks deserialization attempts with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind 2.x before 2.9.10.4, involving deserialization gadget org.apache.commons.proxy.provider.remoting.RmiProvider. The target version (2.15.1-tuxcare.3) already contains the upstream fix that adds this class to the SubTypeValidator blocklist. The fix was shipped in the upstream release 2.15.1 that TuxCare onboarded, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind 2.x before 2.9.10.4, involving deserialization gadget org.apache.commons.proxy.provider.remoting.RmiProvider. The target version (2.15.1-tuxcare.3) already contains the upstream fix that adds this class to the SubTypeValidator blocklist. The fix was shipped in the upstream release 2.15.1 that TuxCare onboarded, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.15.1. The vulnerability involved deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to the SubTypeValidator blocklist) was already included in the upstream release before TuxCare onboarded version 2.15.1. The blocklist entry at line 84 of SubTypeValidator.java prevents this class from being instantiated during polymorphic deserialization, blocking the attack path from malicious JSON input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.15.1. The vulnerability involved deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to the SubTypeValidator blocklist) was already included in the upstream release before TuxCare onboarded version 2.15.1. The blocklist entry at line 84 of SubTypeValidator.java prevents this class from being instantiated during polymorphic deserialization, blocking the attack path from malicious JSON input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08 by Tatu Saloranta on 2020-04-06) added both classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream release 2.15.1 that TuxCare onboarded (commit aa2ac299b6), making it an upstream-provided protection rather than a TuxCare backport. The target's SubTypeValidator.java (lines 52-54) contains both gadget classes in the DEFAULT_NO_DESER_CLASS_NAMES set, confirming the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08 by Tatu Saloranta on 2020-04-06) added both classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream release 2.15.1 that TuxCare onboarded (commit aa2ac299b6), making it an upstream-provided protection rather than a TuxCare backport. The target's SubTypeValidator.java (lines 52-54) contains both gadget classes in the DEFAULT_NO_DESER_CLASS_NAMES set, confirming the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4. The target repository (version 2.15.1-tuxcare.3) contains the upstream fix that blocks deserialization of org.apache.commons.jelly.impl.Embedded. This fix was committed by upstream maintainer Tatu Saloranta on 2020-04-07 (commit 77040d85e3) and first appeared in version 2.9.10.4, well before the target's 2.15.1 base version. The blocklist entry is enforced by SubTypeValidator.validateSubType() which throws a security exception when attempting to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4. The target repository (version 2.15.1-tuxcare.3) contains the upstream fix that blocks deserialization of org.apache.commons.jelly.impl.Embedded. This fix was committed by upstream maintainer Tatu Saloranta on 2020-04-07 (commit 77040d85e3) and first appeared in version 2.9.10.4, well before the target's 2.15.1 base version. The blocklist entry is enforced by SubTypeValidator.validateSubType() which throws a security exception when attempting to deserialize blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target is version 2.15.1-tuxcare.3, which already contains the upstream fix in its base release. The vulnerability involved deserialization of dangerous JNDI-capable classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes). The fix adds these class names to a blacklist in SubTypeValidator.java. All three upstream fix commits (d1c67a0396, 08fbfacf89, ac7232e3f9) are ancestors of the first TuxCare commit (aa2ac299b6 \"Onboard version 2.15.1\"), confirming the fix was already in the upstream 2.15.1 release before TuxCare involvement. The blacklist entries are present and active at SubTypeValidator.java:192,194-195, and validation is enforced during deserialization via BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target is version 2.15.1-tuxcare.3, which already contains the upstream fix in its base release. The vulnerability involved deserialization of dangerous JNDI-capable classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes). The fix adds these class names to a blacklist in SubTypeValidator.java. All three upstream fix commits (d1c67a0396, 08fbfacf89, ac7232e3f9) are ancestors of the first TuxCare commit (aa2ac299b6 \"Onboard version 2.15.1\"), confirming the fix was already in the upstream 2.15.1 release before TuxCare involvement. The blacklist entries are present and active at SubTypeValidator.java:192,194-195, and validation is enforced during deserialization via BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadgets using Oracle JMS classes (oracle.jms.AQjms*) that could lead to arbitrary code execution. The target already contains the upstream fix: all 5 Oracle JMS classes are blacklisted in SubTypeValidator.java (lines 200-204). This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.15.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadgets using Oracle JMS classes (oracle.jms.AQjms*) that could lead to arbitrary code execution. The target already contains the upstream fix: all 5 Oracle JMS classes are blacklisted in SubTypeValidator.java (lines 200-204). This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.15.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 does not affect jackson-databind 2.15.1. The fix for this vulnerability (adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the deserialization blocklist) was included in the upstream 2.9.10.5 release in May 2020 via commit 840eae2ca8. This fix was already present in the upstream 2.15.1 release that TuxCare onboarded (commit aa2ac299b6). The blocklist entry exists at line 119 of SubTypeValidator.java, preventing the JNDI injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 does not affect jackson-databind 2.15.1. The fix for this vulnerability (adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the deserialization blocklist) was included in the upstream 2.9.10.5 release in May 2020 via commit 840eae2ca8. This fix was already present in the upstream 2.15.1 release that TuxCare onboarded (commit aa2ac299b6). The blocklist entry exists at line 119 of SubTypeValidator.java, preventing the JNDI injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.15.1. The vulnerability affects versions before 2.9.10.5, but the target version 2.15.1 is significantly newer and already contains the upstream fix. The blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory exists at line 207 of SubTypeValidator.java, preventing deserialization of this dangerous gadget class. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit f6d9c664f6 and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.15.1. The vulnerability affects versions before 2.9.10.5, but the target version 2.15.1 is significantly newer and already contains the upstream fix. The blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory exists at line 207 of SubTypeValidator.java, preventing deserialization of this dangerous gadget class. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit f6d9c664f6 and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:20:46.497840+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability affects versions before 2.9.10.6 and involves the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The target version (2.15.1) already contains the upstream fix that blocks this class in SubTypeValidator.java line 147. The fix was added by upstream author Tatu Saloranta in commit 3d97153944f7 on August 10, 2020, and was already present in the upstream 2.15.1 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability affects versions before 2.9.10.6 and involves the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The target version (2.15.1) already contains the upstream fix that blocks this class in SubTypeValidator.java line 147. The fix was added by upstream author Tatu Saloranta in commit 3d97153944f7 on August 10, 2020, and was already present in the upstream 2.15.1 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:16:30.596459+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.1 is NOT vulnerable to CVE-2020-24750. The fix blocking deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in the upstream FasterXML/jackson-databind 2.15.1 release that TuxCare onboarded. The vulnerable gadget class is blocked at line 210 of SubTypeValidator.java via the DEFAULT_NO_DESER_CLASS_NAMES deny list. This is an upstream fix (commit 6cc9f1a1af by tatu.saloranta@iki.fi) that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "Target version 2.15.1 is NOT vulnerable to CVE-2020-24750. The fix blocking deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in the upstream FasterXML/jackson-databind 2.15.1 release that TuxCare onboarded. The vulnerable gadget class is blocked at line 210 of SubTypeValidator.java via the DEFAULT_NO_DESER_CLASS_NAMES deny list. This is an upstream fix (commit 6cc9f1a1af by tatu.saloranta@iki.fi) that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.15.1-tuxcare.3. The upstream vendor fix was already included in the 2.15.1 release before TuxCare onboarding. The fix adds two critical XML parser security features to prevent XXE attacks: disallow-doctype-decl=true and nonvalidating/load-external-dtd=false. These protections are present in DOMDeserializer.java lines 40-46, introduced by upstream commit 612f971b78 (Tatu Saloranta, 2020-01-09), which predates the TuxCare onboarding commit aa2ac299b6 (2026-09-20) by over 6 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.15.1-tuxcare.3. The upstream vendor fix was already included in the 2.15.1 release before TuxCare onboarding. The fix adds two critical XML parser security features to prevent XXE attacks: disallow-doctype-decl=true and nonvalidating/load-external-dtd=false. These protections are present in DOMDeserializer.java lines 40-46, introduced by upstream commit 612f971b78 (Tatu Saloranta, 2020-01-09), which predates the TuxCare onboarding commit aa2ac299b6 (2026-09-20) by over 6 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:15.181090+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 and relates to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected because the upstream fix was already present in version 2.15.1 when TuxCare onboarded it. The vulnerable classes are blocked in SubTypeValidator.java lines 217-218, preventing their deserialization. This fix was authored by the upstream maintainer (Tatu Saloranta) and shipped with the original 2.15.1 release, which is significantly newer than the 2.9.10.8 version that first included the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 and relates to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected because the upstream fix was already present in version 2.15.1 when TuxCare onboarded it. The vulnerable classes are blocked in SubTypeValidator.java lines 217-218, preventing their deserialization. This fix was authored by the upstream maintainer (Tatu Saloranta) and shipped with the original 2.15.1 release, which is significantly newer than the 2.9.10.8 version that first included the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:25.010068+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 does not affect jackson-databind 2.15.1. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5 (Dec 2020) by adding these classes to the SubTypeValidator blacklist. This fix was already present in the upstream 2.15.1 release that TuxCare onboarded, as confirmed by checking the onboarding commit aa2ac299b6. The target version 2.15.1 is significantly newer than the affected range (2.x before 2.9.10.8), and the blacklist entries are present at SubTypeValidator.java lines 217-218.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 does not affect jackson-databind 2.15.1. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 41b8bdb5 (Dec 2020) by adding these classes to the SubTypeValidator blacklist. This fix was already present in the upstream 2.15.1 release that TuxCare onboarded, as confirmed by checking the onboarding commit aa2ac299b6. The target version 2.15.1 is significantly newer than the affected range (2.x before 2.9.10.8), and the blacklist entries are present at SubTypeValidator.java lines 217-218.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:51.888467+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a missing blocklist entry for the deserialization gadget com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected because the fix was already present in the upstream 2.15.1 release. The blocklist entry exists at line 240 of SubTypeValidator.java, preventing exploitation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a missing blocklist entry for the deserialization gadget com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository (jackson-databind 2.15.1-tuxcare.3) is not affected because the fix was already present in the upstream 2.15.1 release. The blocklist entry exists at line 240 of SubTypeValidator.java, preventing exploitation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:24:51.671524+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability concerns deserialization gadgets related to DriverAdapterCPDS classes. The upstream vendor (FasterXML) fixed this in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by adding five DriverAdapterCPDS class variants to the SubTypeValidator blacklist. All five entries are present in the target repository at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.1 release before TuxCare onboarded it (first TuxCare commit: aa2ac299b6e431e5dd76e2bd18d9a589958b7f1e). The enforcement mechanism is active, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability concerns deserialization gadgets related to DriverAdapterCPDS classes. The upstream vendor (FasterXML) fixed this in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by adding five DriverAdapterCPDS class variants to the SubTypeValidator blacklist. All five entries are present in the target repository at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.1 release before TuxCare onboarded it (first TuxCare commit: aa2ac299b6e431e5dd76e2bd18d9a589958b7f1e). The enforcement mechanism is active, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:37:21.976714+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is not present in jackson-databind 2.15.1-tuxcare.3. The upstream vendor (FasterXML) already fixed this vulnerability in commit 3ded28aece (December 31, 2020) by adding org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related class variants to the deserialization blocklist. This fix was included in the upstream 2.15.1 release, which TuxCare onboarded in September 2026. The target repository contains all five blocklist entries from the patch, preventing deserialization of the dangerous DBCP classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is not present in jackson-databind 2.15.1-tuxcare.3. The upstream vendor (FasterXML) already fixed this vulnerability in commit 3ded28aece (December 31, 2020) by adding org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related class variants to the deserialization blocklist. This fix was included in the upstream 2.15.1 release, which TuxCare onboarded in September 2026. The target repository contains all five blocklist entries from the patch, preventing deserialization of the dangerous DBCP classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:20.075693+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, which mishandle deserialization of the org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS gadget class. The target version 2.15.1 already includes the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b) that was shipped in jackson-databind 2.9.10.8. The fix adds the gadget class to SubTypeValidator's blocklist, preventing its deserialization. This is an upstream fix that shipped before TuxCare onboarded version 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, which mishandle deserialization of the org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS gadget class. The target version 2.15.1 already includes the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b) that was shipped in jackson-databind 2.9.10.8. The fix adds the gadget class to SubTypeValidator's blocklist, preventing its deserialization. This is an upstream fix that shipped before TuxCare onboarded version 2.15.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:59.877228+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which could lead to arbitrary code execution. The fix was already included in the upstream 2.15.1 release (commit 3ded28aece by Tatu Saloranta) before TuxCare onboarded this version. The dangerous class is blocked in SubTypeValidator.java at line 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which could lead to arbitrary code execution. The fix was already included in the upstream 2.15.1 release (commit 3ded28aece by Tatu Saloranta) before TuxCare onboarded this version. The dangerous class is blocked in SubTypeValidator.java at line 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:21:27.770551+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerable deserialization gadget org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked by the upstream-provided blacklist in SubTypeValidator.java:243. The fix was committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-12-31 in commit 12e23c962ff, shipped in upstream jackson-databind 2.12.1+ (January 2021), and was already present in the upstream 2.15.1 release (May 2023) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerable deserialization gadget org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked by the upstream-provided blacklist in SubTypeValidator.java:243. The fix was committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-12-31 in commit 12e23c962ff, shipped in upstream jackson-databind 2.12.1+ (January 2021), and was already present in the upstream 2.15.1 release (May 2023) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.15.1-tuxcare.3. The upstream fix (commit 567194c53ae by Tatu Saloranta) was already included in version 2.15.1 when TuxCare onboarded it. The SubTypeValidator blacklist at lines 235-236 contains the required entries blocking org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource, preventing the deserialization gadget exploit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.15.1-tuxcare.3. The upstream fix (commit 567194c53ae by Tatu Saloranta) was already included in version 2.15.1 when TuxCare onboarded it. The SubTypeValidator blacklist at lines 235-236 contains the required entries blocking org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource, preventing the deserialization gadget exploit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:30.945793+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.15.1. The vulnerability involves deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource that were blocklisted by upstream in commit 567194c53a (Dec 26, 2020) as part of the 2.9.10.8 release. This fix shipped in the upstream 2.15.1 release before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.15.1. The vulnerability involves deserialization gadgets org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource that were blocklisted by upstream in commit 567194c53a (Dec 26, 2020) as part of the 2.9.10.8 release. This fix shipped in the upstream 2.15.1 release before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:33:25.079742+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources classes. The target (jackson-databind 2.15.1-tuxcare.3) contains the upstream fix that adds these classes to the deserialization blocklist in SubTypeValidator.java (lines 229-230). The fix was already present in the upstream 2.15.1 release, authored by Tatu Saloranta (upstream maintainer), before TuxCare onboarding. The vulnerable code pattern is not present - polymorphic deserialization of PerUserPoolDataSource and SharedPoolDataSource is blocked by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources classes. The target (jackson-databind 2.15.1-tuxcare.3) contains the upstream fix that adds these classes to the deserialization blocklist in SubTypeValidator.java (lines 229-230). The fix was already present in the upstream 2.15.1 release, authored by Tatu Saloranta (upstream maintainer), before TuxCare onboarding. The vulnerable code pattern is not present - polymorphic deserialization of PerUserPoolDataSource and SharedPoolDataSource is blocked by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:46:28.565161+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2020-36187. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) added this class to the deserialization blacklist in SubTypeValidator.java, and this fix was already present in the upstream 2.15.1 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "The target jackson-databind 2.15.1-tuxcare.3 is not affected by CVE-2020-36187. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The upstream fix (commit 3e8fa3beea) added this class to the deserialization blacklist in SubTypeValidator.java, and this fix was already present in the upstream 2.15.1 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:52:11.742351+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, involving deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target repository is jackson-databind version 2.15.1-tuxcare.3, which already contains the upstream fix. The fix (commit 33d96c13fe) was authored by Tatu Saloranta (upstream maintainer) and was included in the upstream 2.15.1 release before TuxCare onboarded it. The blocklist entries are present in SubTypeValidator.java at lines 223-224, and the validateSubType method enforces them by throwing a JsonMappingException when these classes are encountered during polymorphic deserialization. The vulnerable pattern was never present in the version TuxCare started from.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, involving deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target repository is jackson-databind version 2.15.1-tuxcare.3, which already contains the upstream fix. The fix (commit 33d96c13fe) was authored by Tatu Saloranta (upstream maintainer) and was included in the upstream 2.15.1 release before TuxCare onboarded it. The blocklist entries are present in SubTypeValidator.java at lines 223-224, and the validateSubType method enforces them by throwing a JsonMappingException when these classes are encountered during polymorphic deserialization. The vulnerable pattern was never present in the version TuxCare started from.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.15.1. The vulnerability required the absence of blocklist entries for two newrelic-agent embedded logback classes that could be exploited as deserialization gadgets. The upstream fix (commit 33d96c13fe by tatu.saloranta@iki.fi) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist and shipped in the upstream 2.15.1 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 223-224, and SubTypeValidator is invoked during bean deserialization via BeanDeserializerFactory line 1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.15.1. The vulnerability required the absence of blocklist entries for two newrelic-agent embedded logback classes that could be exploited as deserialization gadgets. The upstream fix (commit 33d96c13fe by tatu.saloranta@iki.fi) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist and shipped in the upstream 2.15.1 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java lines 223-224, and SubTypeValidator is invoked during bean deserialization via BeanDeserializerFactory line 1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:16:13.721778+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 affects jackson-databind versions that use unbounded recursion during deserialization of deeply nested JSON, leading to stack overflow DoS. Version 2.15.1 uses UntypedObjectDeserializerNR by default, which employs non-recursive iterative processing to prevent stack overflow. The fix (commit 8238ab41d0) was authored by upstream maintainer tatu.saloranta@iki.fi and shipped in the upstream 2.15.1 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 affects jackson-databind versions that use unbounded recursion during deserialization of deeply nested JSON, leading to stack overflow DoS. Version 2.15.1 uses UntypedObjectDeserializerNR by default, which employs non-recursive iterative processing to prevent stack overflow. The fix (commit 8238ab41d0) was authored by upstream maintainer tatu.saloranta@iki.fi and shipped in the upstream 2.15.1 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:47.660203+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2. The target version 2.15.1-tuxcare.3 is not vulnerable because the fix was already included in the upstream jackson-databind 2.15.1 release. The dangerous class org.apache.xbean.propertyeditor.JndiConverter is present in the deserialization blacklist at SubTypeValidator.java:138, preventing the JNDI-based remote code execution attack. This fix was authored by upstream maintainer Tatu Saloranta (commit 914e7c9f) and was part of the upstream 2.15.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 affects jackson-databind versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2. The target version 2.15.1-tuxcare.3 is not vulnerable because the fix was already included in the upstream jackson-databind 2.15.1 release. The dangerous class org.apache.xbean.propertyeditor.JndiConverter is present in the deserialization blacklist at SubTypeValidator.java:138, preventing the JNDI-based remote code execution attack. This fix was authored by upstream maintainer Tatu Saloranta (commit 914e7c9f) and was part of the upstream 2.15.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves unsafe deserialization of the HikariConfig gadget class. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) added \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" to the SubTypeValidator blocklist, preventing deserialization of this dangerous class. This fix was already present in upstream version 2.15.1 when TuxCare onboarded it (commit aa2ac299b6). The target repository contains the complete defense at SubTypeValidator.java:141, which blocks the attack INPUT (JSON with HikariConfig type metadata) from reaching the GOAL (arbitrary class instantiation during deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves unsafe deserialization of the HikariConfig gadget class. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) added \"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\" to the SubTypeValidator blocklist, preventing deserialization of this dangerous class. This fix was already present in upstream version 2.15.1 when TuxCare onboarded it (commit aa2ac299b6). The target repository contains the complete defense at SubTypeValidator.java:141, which blocks the attack INPUT (JSON with HikariConfig type metadata) from reaching the GOAL (arbitrary class instantiation during deserialization).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:43:13.146994+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadgets, specifically com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The vendor fix adds this class to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java. This fix is present at line 144 of the target's SubTypeValidator.java and was shipped in the upstream FasterXML jackson-databind 2.15.1 release, before TuxCare onboarding. The blacklist entry blocks deserialization of the dangerous gadget class, preventing exploitation. Fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream author tatu.saloranta@iki.fi.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.15.1-tuxcare.3. The vulnerability involves deserialization gadgets, specifically com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The vendor fix adds this class to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java. This fix is present at line 144 of the target's SubTypeValidator.java and was shipped in the upstream FasterXML jackson-databind 2.15.1 release, before TuxCare onboarding. The blacklist entry blocks deserialization of the dangerous gadget class, preventing exploitation. Fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream author tatu.saloranta@iki.fi.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:04.637381+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is a deserialization gadget vulnerability related to br.com.anteros.dbcp.AnterosDBCPConfig. The fix adds this class to a blocklist in SubTypeValidator.java to prevent malicious deserialization. The target repository (jackson-databind 2.15.1-tuxcare.3) already contains this fix, which was introduced by upstream maintainer Tatu Saloranta in version 2.9.10.4. Since the target version 2.15.1 is significantly newer than 2.9.10.4, it inherited this fix from the upstream release that TuxCare onboarded. The blocklist entry is present at line 145 of SubTypeValidator.java and is actively enforced by the deserialization framework.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is a deserialization gadget vulnerability related to br.com.anteros.dbcp.AnterosDBCPConfig. The fix adds this class to a blocklist in SubTypeValidator.java to prevent malicious deserialization. The target repository (jackson-databind 2.15.1-tuxcare.3) already contains this fix, which was introduced by upstream maintainer Tatu Saloranta in version 2.9.10.4. Since the target version 2.15.1 is significantly newer than 2.9.10.4, it inherited this fix from the upstream release that TuxCare onboarded. The blocklist entry is present at line 145 of SubTypeValidator.java and is actively enforced by the deserialization framework.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:02.250684+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 (javax.swing.JTextPane deserialization gadget) is not present in jackson-databind 2.15.1-tuxcare.3. The upstream fix (commit 7dbf51bf78 by Tatu Saloranta, Sep 17 2020) adding JTextPane to the SubTypeValidator blocklist was already included in the upstream 2.15.1 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 (javax.swing.JTextPane deserialization gadget) is not present in jackson-databind 2.15.1-tuxcare.3. The upstream fix (commit 7dbf51bf78 by Tatu Saloranta, Sep 17 2020) adding JTextPane to the SubTypeValidator blocklist was already included in the upstream 2.15.1 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.1-tuxcare.3 is NOT AFFECTED by CVE-2021-46877. The vulnerability involving excessive heap allocation (2GB transient memory) during JDK deserialization of JsonNode objects with maliciously inflated length fields was fixed by upstream author Tatu Saloranta in commit 3ccde7d938 (December 2021). This fix was already present in upstream jackson-databind 2.15.1 when TuxCare onboarded that version (commit aa2ac299b6 by amoniatovskiy@cloudlinux.com). The target's NodeSerialization.java contains the complete fix: LONGEST_EAGER_ALLOC=100KB limit and incremental ByteArrayBuilder-based reading for larger payloads, preventing allocation based solely on attacker-controlled length fields.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "Target version 2.15.1-tuxcare.3 is NOT AFFECTED by CVE-2021-46877. The vulnerability involving excessive heap allocation (2GB transient memory) during JDK deserialization of JsonNode objects with maliciously inflated length fields was fixed by upstream author Tatu Saloranta in commit 3ccde7d938 (December 2021). This fix was already present in upstream jackson-databind 2.15.1 when TuxCare onboarded that version (commit aa2ac299b6 by amoniatovskiy@cloudlinux.com). The target's NodeSerialization.java contains the complete fix: LONGEST_EAGER_ALLOC=100KB limit and incremental ByteArrayBuilder-based reading for larger payloads, preventing allocation based solely on attacker-controlled length fields.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:45:42.706698+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is NOT present in jackson-databind 2.15.1. The vulnerability affecting primitive value deserializers (resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.13.4.2/2.14.0. The target version 2.15.1 includes the upstream fix (commit d78d00ee7b by Tatu Saloranta) which adds checks in StdDeserializer primitive parsers and BeanDeserializer to reject nested arrays after the first unwrap, preventing unbounded recursion. The fix was part of the upstream 2.15.1 release that TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 is NOT present in jackson-databind 2.15.1. The vulnerability affecting primitive value deserializers (resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.13.4.2/2.14.0. The target version 2.15.1 includes the upstream fix (commit d78d00ee7b by Tatu Saloranta) which adds checks in StdDeserializer primitive parsers and BeanDeserializer to reject nested arrays after the first unwrap, preventing unbounded recursion. The fix was part of the upstream 2.15.1 release that TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T14:18:02.736616+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Version 2.15.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected below 2.13.4), NVD (affected below 2.13.4), Snyk (affected below 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "Version 2.15.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rgv9-q543-rqg4 (affected below 2.13.4), NVD (affected below 2.13.4), Snyk (affected below 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:19:00.068472+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability (stack overflow in JsonNode.toString() with deeply nested JSON) was fixed in upstream 2.14.0 via commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by Tatu Saloranta. The target version 2.15.1 was released after 2.14.0 and already contained the fix when TuxCare onboarded it. The vulnerable recursive serialization...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 is not present in jackson-databind 2.15.1-tuxcare.3. The vulnerability (stack overflow in JsonNode.toString() with deeply nested JSON) was fixed in upstream 2.14.0 via commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by Tatu Saloranta. The target version 2.15.1 was released after 2.14.0 and already contained the fix when TuxCare onboarded it. The vulnerable recursive serialization..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T03:08:00.087277+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target version 2.15.1-tuxcare.3 is NOT AFFECTED by CVE-2026-54516. The vulnerability exists in versions >= 2.21.0 where commit 1fe6ee7a89 (issue #5398, dated 2025-11-19) introduced special handling for renamed properties with ignored setters in POJOPropertiesCollector._renameProperties(). That code path does not exist in 2.15.1. The fix (#5967, commit c3d56dd) adds prop.removeFields() to st...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "impact_statement": "not_affected \u2014 The target version 2.15.1-tuxcare.3 is NOT AFFECTED by CVE-2026-54516. The vulnerability exists in versions >= 2.21.0 where commit 1fe6ee7a89 (issue #5398, dated 2025-11-19) introduced special handling for renamed properties with ignored setters in POJOPropertiesCollector._renameProperties(). That code path does not exist in 2.15.1. The fix (#5967, commit c3d56dd) adds prop.removeFields() to st..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:17:00.447062+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because @JsonUnwrapped creator parameters are rejected, preventing the vulnerable replay of buffered JSON into constructor arguments. Unnamed parameters are rejected at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:870, and named creator properties are rejected when unwrapping is resolved at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:934.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because @JsonUnwrapped creator parameters are rejected, preventing the vulnerable replay of buffered JSON into constructor arguments. Unnamed parameters are rejected at src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:870, and named creator properties are rejected when unwrapping is resolved at src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:934."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:02:00.095163+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:02:00.095163+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:02:00.095163+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:02:00.095163+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.15.1-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:01:35.652626+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.15.1-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}