{
  "@id": "urn:uuid:de614f7c-5b3e-450b-baec-c890f2a83e06",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 90,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:52:00.056307+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:05:07.573388+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target repository is at version 2.15.4-tuxcare.4, which already contains the upstream fix. The SubTypeValidator defense mechanism (blacklisting dangerous deserialization classes like TemplatesImpl) was introduced by upstream author tatu.saloranta@iki.fi and is present and active in the target. The fix commit (2235894210c75f624a3d0cd60bfb0434a20a18bf) is an ancestor of the TuxCare onboarding commit (8ebc175718f00bab78aeddca1350b96e4bbaa378), confirming the fix was already in the upstream 2.15.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target repository is at version 2.15.4-tuxcare.4, which already contains the upstream fix. The SubTypeValidator defense mechanism (blacklisting dangerous deserialization classes like TemplatesImpl) was introduced by upstream author tatu.saloranta@iki.fi and is present and active in the target. The fix commit (2235894210c75f624a3d0cd60bfb0434a20a18bf) is an ancestor of the TuxCare onboarding commit (8ebc175718f00bab78aeddca1350b96e4bbaa378), confirming the fix was already in the upstream 2.15.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:41:15.361284+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2017-17485. The vulnerability affected versions through 2.8.10 and 2.9.x through 2.9.3 (Dec 2017). The fix was committed by upstream maintainer Tatu Saloranta in Dec 2017 (issues #1737, #1855) introducing SubTypeValidator with comprehensive blacklisting and pattern-based validation for Spring/C3P0 gadget classes. This fix was included in upstream 2.15.4 release (2023) before TuxCare onboarded it. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target jackson-databind 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2017-17485. The vulnerability affected versions through 2.8.10 and 2.9.x through 2.9.3 (Dec 2017). The fix was committed by upstream maintainer Tatu Saloranta in Dec 2017 (issues #1737, #1855) introducing SubTypeValidator with comprehensive blacklisting and pattern-based validation for Spring/C3P0 gadget classes. This fix was included in upstream 2.15.4 release (2023) before TuxCare onboarded it. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:25:18.997176+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.4-tuxcare.4 is NOT affected by CVE-2017-7525. The vulnerability (unsafe deserialization of attacker-specified classes via Jackson polymorphic typing) is not present because the fix was already included in upstream release 2.15.4. The fix implements a blocklist check in SubTypeValidator that rejects dangerous gadget classes (TemplatesImpl, InvokerTransformer, etc.) before deserialization, preventing the code execution chain. Fix authored by Tatu Saloranta (upstream maintainer) in commit fa87c1ddbe, which was present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "Target version 2.15.4-tuxcare.4 is NOT affected by CVE-2017-7525. The vulnerability (unsafe deserialization of attacker-specified classes via Jackson polymorphic typing) is not present because the fix was already included in upstream release 2.15.4. The fix implements a blocklist check in SubTypeValidator that rejects dangerous gadget classes (TemplatesImpl, InvokerTransformer, etc.) before deserialization, preventing the code execution chain. Fix authored by Tatu Saloranta (upstream maintainer) in commit fa87c1ddbe, which was present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:59.149107+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, allowing data exfiltration via the iBatis XPathParser gadget class with default typing. The target repository (jackson-databind 2.15.4-tuxcare.4) contains the upstream fix that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present in the upstream 2.15.4 release that TuxCare onboarded, making this an upstream-fixed version rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5, allowing data exfiltration via the iBatis XPathParser gadget class with default typing. The target repository (jackson-databind 2.15.4-tuxcare.4) contains the upstream fix that blacklists org.apache.ibatis.parsing.XPathParser in SubTypeValidator.java. This fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and was already present in the upstream 2.15.4 release that TuxCare onboarded, making this an upstream-fixed version rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:15:39.453186+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.4 is NOT AFFECTED by CVE-2018-12022. The vulnerability requires polymorphic deserialization of dangerous Jodd-db classes (jodd.db.connection.DataSourceConnectionProvider) and Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. These three classes are already blacklisted in SubTypeValidator.java (lines 67-72), preventing their deserialization. The fix was added by upstream FasterXML author Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a on June 7, 2018, for version 2.7.9.4. Since the target is version 2.15.4 (released in 2023, 5 years later), the fix was already present in the upstream release that TuxCare onboarded. The blacklist is enforced during bean deserializer creation via BeanDeserializerFactory._validateSubType() (line 141), which calls SubTypeValidator.validateSubType() to block dangerous types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "Target version 2.15.4 is NOT AFFECTED by CVE-2018-12022. The vulnerability requires polymorphic deserialization of dangerous Jodd-db classes (jodd.db.connection.DataSourceConnectionProvider) and Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled. These three classes are already blacklisted in SubTypeValidator.java (lines 67-72), preventing their deserialization. The fix was added by upstream FasterXML author Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a on June 7, 2018, for version 2.7.9.4. Since the target is version 2.15.4 (released in 2023, 5 years later), the fix was already present in the upstream release that TuxCare onboarded. The blacklist is enforced during bean deserializer creation via BeanDeserializerFactory._validateSubType() (line 141), which calls SubTypeValidator.validateSubType() to block dangerous types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:47.656427+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind when polymorphic type handling (Default Typing) is enabled and Oracle JDBC classes are exploited for JNDI/LDAP-based deserialization attacks. The target version 2.15.4-tuxcare.4 is NOT affected because the upstream vendor fix (commit 28badf7ef6 from June 2018) that blocks deserialization of oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet is already present in the upstream release. The blocklist entries exist at SubTypeValidator.java:70-72 and are enforced during type validation, preventing the attack chain from reaching arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind when polymorphic type handling (Default Typing) is enabled and Oracle JDBC classes are exploited for JNDI/LDAP-based deserialization attacks. The target version 2.15.4-tuxcare.4 is NOT affected because the upstream vendor fix (commit 28badf7ef6 from June 2018) that blocks deserialization of oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet is already present in the upstream release. The blocklist entries exist at SubTypeValidator.java:70-72 and are enforced during type validation, preventing the attack chain from reaching arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:43:26.013143+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The upstream FasterXML maintainer (Tatu Saloranta) applied the fix in commit 87d29af25e, which was already present in the upstream jackson-databind 2.15.4 release that TuxCare onboarded. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocklisted in SubTypeValidator.java and the validation is enforced during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target version 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The upstream FasterXML maintainer (Tatu Saloranta) applied the fix in commit 87d29af25e, which was already present in the upstream jackson-databind 2.15.4 release that TuxCare onboarded. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocklisted in SubTypeValidator.java and the validation is enforced during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:36.777269+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for blaze-ds-opt and blaze-ds-core classes. The target repository is jackson-databind 2.15.4-tuxcare.4, which already contains the upstream fix. The fix (commit 87d29af25e) was authored by Tatu Saloranta (upstream maintainer) and was included in the upstream 2.15.4 release that TuxCare onboarded. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the blocklist at SubTypeValidator.java:75-78 and actively enforced by the validation logic at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for blaze-ds-opt and blaze-ds-core classes. The target repository is jackson-databind 2.15.4-tuxcare.4, which already contains the upstream fix. The fix (commit 87d29af25e) was authored by Tatu Saloranta (upstream maintainer) and was included in the upstream 2.15.4 release that TuxCare onboarded. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the blocklist at SubTypeValidator.java:75-78 and actively enforced by the validation logic at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:04:52.776712+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns missing blocklist entries for four dangerous classes in polymorphic deserialization. The upstream fix (commit 87d29af25e) added org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to DEFAULT_NO_DESER_CLASS_NAMES. This fix was already present in upstream release 2.15.4 before TuxCare onboarded it. The blocklist was later refactored from BeanDeserializerFactory to SubTypeValidator but remains actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns missing blocklist entries for four dangerous classes in polymorphic deserialization. The upstream fix (commit 87d29af25e) added org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to DEFAULT_NO_DESER_CLASS_NAMES. This fix was already present in upstream release 2.15.4 before TuxCare onboarded it. The blocklist was later refactored from BeanDeserializerFactory to SubTypeValidator but remains actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:33:25.079742+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entries for dangerous classes enabling SSRF via polymorphic deserialization. The target version 2.15.4 already contains the upstream fix (commit 0899726ec34 by Tatu Saloranta, August 2018) which adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.15.4 that TuxCare onboarded (commit 8ebc175718f \"Onboard version 2.15.4\"). The defense is active and invoked during bean deserialization via BeanDeserializerFactory._validateSubType() \u2192 SubTypeValidator.validateSubType(), which rejects any attempt to deserialize the blocked class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entries for dangerous classes enabling SSRF via polymorphic deserialization. The target version 2.15.4 already contains the upstream fix (commit 0899726ec34 by Tatu Saloranta, August 2018) which adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.15.4 that TuxCare onboarded (commit 8ebc175718f \"Onboard version 2.15.4\"). The defense is active and invoked during bean deserialization via BeanDeserializerFactory._validateSubType() \u2192 SubTypeValidator.validateSubType(), which rejects any attempt to deserialize the blocked class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:40:27.887885+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability required blocking org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. This fix was already included in upstream release 2.15.4 via commit 72cd4025a229fb28ec133235003dd4616f70afaa (authored by Tatu Saloranta) before TuxCare onboarded the version. The blocklist entry exists at line 85 of SubTypeValidator.java, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability required blocking org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. This fix was already included in upstream release 2.15.4 via commit 72cd4025a229fb28ec133235003dd4616f70afaa (authored by Tatu Saloranta) before TuxCare onboarded the version. The blocklist entry exists at line 85 of SubTypeValidator.java, preventing deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:54:24.400671+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind 2.15.4 is NOT affected by CVE-2018-19361. The vulnerability concerns missing blocklist entries for OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) in polymorphic deserialization validation. The target code contains these blocklist entries at lines 82-83 of SubTypeValidator.java. The fix was committed by upstream Jackson maintainer Tatu Saloranta on 2018-11-19 (commit 72cd4025a2) and was included in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable code pattern (absence of openjpa blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "Target repository jackson-databind 2.15.4 is NOT affected by CVE-2018-19361. The vulnerability concerns missing blocklist entries for OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) in polymorphic deserialization validation. The target code contains these blocklist entries at lines 82-83 of SubTypeValidator.java. The fix was committed by upstream Jackson maintainer Tatu Saloranta on 2018-11-19 (commit 72cd4025a2) and was included in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable code pattern (absence of openjpa blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:23:22.459243+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for jboss-common-core and related classes in polymorphic deserialization. The target version 2.15.4-tuxcare.4 contains the upstream fix that adds org.jboss.util.propertyeditor.DocumentEditor and three other gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.15.4 release when TuxCare onboarded it, authored by the upstream Jackson maintainer Tatu Saloranta. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for jboss-common-core and related classes in polymorphic deserialization. The target version 2.15.4-tuxcare.4 contains the upstream fix that adds org.jboss.util.propertyeditor.DocumentEditor and three other gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.15.4 release when TuxCare onboarded it, authored by the upstream Jackson maintainer Tatu Saloranta. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve remote code execution. The fix adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.4 release before TuxCare onboarded it, as confirmed by git ancestry analysis showing fix commit 038b471e2e is an ancestor of the first TuxCare onboarding commit 8ebc175718f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involved two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve remote code execution. The fix adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.15.4 release before TuxCare onboarded it, as confirmed by git ancestry analysis showing fix commit 038b471e2e is an ancestor of the first TuxCare onboarding commit 8ebc175718f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:59.528750+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.4-tuxcare.4 contains the upstream fix for CVE-2018-7489 that was shipped in upstream release 2.15.4. The fix blocks deserialization of c3p0 connection pool classes by rejecting any type whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\". The vulnerable pattern is not present because the upstream fix removed it before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target version 2.15.4-tuxcare.4 contains the upstream fix for CVE-2018-7489 that was shipped in upstream release 2.15.4. The fix blocks deserialization of c3p0 connection pool classes by rejecting any type whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\". The vulnerable pattern is not present because the upstream fix removed it before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target is version 2.15.4, which already contains the upstream fix. The vulnerable pattern (missing validation for com.mysql.cj.jdbc.admin.MiniAdmin in polymorphic deserialization) is not present. SubTypeValidator.java line 88 contains the defense: s.add(\"com.mysql.cj.jdbc.admin.MiniAdmin\"), blocking this gadget class from deserialization. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd72 and shipped in the upstream 2.15.4 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target is version 2.15.4, which already contains the upstream fix. The vulnerable pattern (missing validation for com.mysql.cj.jdbc.admin.MiniAdmin in polymorphic deserialization) is not present. SubTypeValidator.java line 88 contains the defense: s.add(\"com.mysql.cj.jdbc.admin.MiniAdmin\"), blocking this gadget class from deserialization. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit dda513bd72 and shipped in the upstream 2.15.4 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:26:34.536862+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2019-12384. The vulnerability required the ability to deserialize the logback-core class \"ch.qos.logback.core.db.DriverManagerConnectionSource\" for polymorphic deserialization attacks. The upstream fix (commit c9ef4a10d6f) added this class to the deserialization blocklist in SubTypeValidator.java, and this fix shippe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2019-12384. The vulnerability required the ability to deserialize the logback-core class \"ch.qos.logback.core.db.DriverManagerConnectionSource\" for polymorphic deserialization attacks. The upstream fix (commit c9ef4a10d6f) added this class to the deserialization blocklist in SubTypeValidator.java, and this fix shippe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:07:50.518995+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 (JDOM XSLTransformer deserialization gadget) is NOT present in jackson-databind 2.15.4-tuxcare.4. The fix was already included in the upstream 2.15.4 release that TuxCare onboarded. The SubTypeValidator class contains the required blocklist entries for org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer (lines 93-95), preventing polymorphic deserialization of...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 (JDOM XSLTransformer deserialization gadget) is NOT present in jackson-databind 2.15.4-tuxcare.4. The fix was already included in the upstream 2.15.4 release that TuxCare onboarded. The SubTypeValidator class contains the required blocklist entries for org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer (lines 93-95), preventing polymorphic deserialization of..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream fix (commit ad418eeb97) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.15.4 when TuxCare onboarded it, so the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream fix (commit ad418eeb97) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.15.4 when TuxCare onboarded it, so the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:28:43.500801+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback jar is in classpath, allowing polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource for potential RCE. The target (jackson-databind 2.15.4-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.15.4 release that TuxCare onboarded. The dangerous class is blocklisted at SubTypeValidator.java:102, preventing its deserialization. Fix commit ad418eeb97 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) was already an ancestor of the first TuxCare commit (8ebc175718 \"Onboard version 2.15.4\"), confirming this is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 when Default Typing is enabled and logback jar is in classpath, allowing polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource for potential RCE. The target (jackson-databind 2.15.4-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.15.4 release that TuxCare onboarded. The dangerous class is blocklisted at SubTypeValidator.java:102, preventing its deserialization. Fix commit ad418eeb97 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) was already an ancestor of the first TuxCare commit (8ebc175718 \"Onboard version 2.15.4\"), confirming this is an upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:06.899174+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves polymorphic deserialization gadgets using HikariConfig/HikariDataSource classes. The fix was already present in the upstream 2.15.4 release when TuxCare onboarded it. The SubTypeValidator blocklist at lines 104-107 of SubTypeValidator.java contains entries for both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource, preventing their deserialization. The fix commits (d4983c740f and 73c1c2cc76) by upstream maintainer Tatu Saloranta are ancestors of the onboarding commit (8ebc175718), confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves polymorphic deserialization gadgets using HikariConfig/HikariDataSource classes. The fix was already present in the upstream 2.15.4 release when TuxCare onboarded it. The SubTypeValidator blocklist at lines 104-107 of SubTypeValidator.java contains entries for both com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource, preventing their deserialization. The fix commits (d4983c740f and 73c1c2cc76) by upstream maintainer Tatu Saloranta are ancestors of the onboarding commit (8ebc175718), confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:53:08.340092+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves polymorphic deserialization of org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration classes, which could enable arbitrary code execution via JNDI lookups. The fix (commit 41b7f9b901) adds these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in upstream version 2.15.4 when TuxCare onboarded it. The blocklist entries are active at SubTypeValidator.java:113-114, and the validation is mandatory for all polymorphic deserialization operations, with no configuration to disable it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves polymorphic deserialization of org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration classes, which could enable arbitrary code execution via JNDI lookups. The fix (commit 41b7f9b901) adds these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and was already present in upstream version 2.15.4 when TuxCare onboarded it. The blocklist entries are active at SubTypeValidator.java:113-114, and the validation is mandatory for all polymorphic deserialization operations, with no configuration to disable it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.15.4-tuxcare.4. The upstream fix (commit 998efd7082) that blocks the xalan JNDI gadget class org.apache.xalan.lib.sql.JNDIConnectionPool from polymorphic deserialization was already included in the jackson-databind 2.15.4 release before TuxCare onboarded it. The SubTypeValidator blocklist at line 117 prevents instantiation of this dangerous class, eliminating the arbitrary code execution risk described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.15.4-tuxcare.4. The upstream fix (commit 998efd7082) that blocks the xalan JNDI gadget class org.apache.xalan.lib.sql.JNDIConnectionPool from polymorphic deserialization was already included in the jackson-databind 2.15.4 release before TuxCare onboarded it. The SubTypeValidator blocklist at line 117 prevents instantiation of this dangerous class, eliminating the arbitrary code execution risk described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:02:28.386699+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.15.4-tuxcare.4 is not affected by CVE-2019-16335. The vulnerability pattern (polymorphic deserialization of com.zaxxer.hikari.HikariDataSource) is not present because it was fixed in upstream commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db, which was already included in the upstream 2.15.4 release that TuxCare onboarded. The fix adds \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator blacklist at line 107, preventing its polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "The target repository jackson-databind 2.15.4-tuxcare.4 is not affected by CVE-2019-16335. The vulnerability pattern (polymorphic deserialization of com.zaxxer.hikari.HikariDataSource) is not present because it was fixed in upstream commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db, which was already included in the upstream 2.15.4 release that TuxCare onboarded. The fix adds \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator blacklist at line 107, preventing its polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:48.956683+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.15.4-tuxcare.4. The upstream vendor (FasterXML) fixed this polymorphic typing vulnerability in version 2.9.10.1 by adding org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, and com.p6spy.engine.spy.P6DataSource to the SubTypeValidator blocklist. This fix was shipped in upstream release 2.15.4, which TuxCare onboarded. The target contains the complete fix at SubTypeValidator.java lines 121-127.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.15.4-tuxcare.4. The upstream vendor (FasterXML) fixed this polymorphic typing vulnerability in version 2.9.10.1 by adding org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, and com.p6spy.engine.spy.P6DataSource to the SubTypeValidator blocklist. This fix was shipped in upstream release 2.15.4, which TuxCare onboarded. The target contains the complete fix at SubTypeValidator.java lines 121-127.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:12:26.130269+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves polymorphic deserialization of malicious p6spy and commons-dbcp classes when Default Typing is enabled. The upstream fix (commits 9593e16cf5 and 328a0f833d by Tatu Saloranta) added com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and org.apache.commons.dbcp.datasources.PerUserPoolDataSource to the SubTypeValidator blocklist. These fix commits were already present in the upstream 2.15.4 release before TuxCare onboarded the version (first TuxCare commit: 8ebc175718). The blocklist entries are present in the target at SubTypeValidator.java lines 121-127, and SubTypeValidator.validateSubType() is actively called during bean deserialization at BeanDeserializerFactory.java:1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves polymorphic deserialization of malicious p6spy and commons-dbcp classes when Default Typing is enabled. The upstream fix (commits 9593e16cf5 and 328a0f833d by Tatu Saloranta) added com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and org.apache.commons.dbcp.datasources.PerUserPoolDataSource to the SubTypeValidator blocklist. These fix commits were already present in the upstream 2.15.4 release before TuxCare onboarded the version (first TuxCare commit: 8ebc175718). The blocklist entries are present in the target at SubTypeValidator.java lines 121-127, and SubTypeValidator.validateSubType() is actively called during bean deserialization at BeanDeserializerFactory.java:1032.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:39.614024+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.4-tuxcare.4) is not affected by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the gadget class \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\". The fix (adding this class to the SubTypeValidator blocklist) is already present in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java line 99. This fix was shipped in upstream version 2.15.4 (commit 191a4cdf87 by Tatu Saloranta) before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target repository (jackson-databind 2.15.4-tuxcare.4) is not affected by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the gadget class \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\". The fix (adding this class to the SubTypeValidator blocklist) is already present in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java line 99. This fix was shipped in upstream version 2.15.4 (commit 191a4cdf87 by Tatu Saloranta) before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:45:46.897208+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target version 2.15.4-tuxcare.4 is much newer and already contains the upstream fix. The vulnerability required blocklist entries for two log4j-extras gadget classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to prevent deserialization-based JNDI injection attacks. These blocklist entries are present in SubTypeValidator.java at lines 129-131, having been committed upstream by Tatu Saloranta (tatu.saloranta@iki.fi) in October 2019 (commit b5a304a9). The fix was already included in upstream jackson-databind 2.15.4 when TuxCare onboarded this version, so no backport was required. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target version 2.15.4-tuxcare.4 is much newer and already contains the upstream fix. The vulnerability required blocklist entries for two log4j-extras gadget classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to prevent deserialization-based JNDI injection attacks. These blocklist entries are present in SubTypeValidator.java at lines 129-131, having been committed upstream by Tatu Saloranta (tatu.saloranta@iki.fi) in October 2019 (commit b5a304a9). The fix was already included in upstream jackson-databind 2.15.4 when TuxCare onboarded this version, so no backport was required. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability required adding two ehcache classes (GenericJndiSelector and GlassfishSelector) to the SubTypeValidator blocklist. These entries are present at lines 134-135 of SubTypeValidator.java. The fix was added by upstream maintainer Tatu Saloranta in commit fc4214a883d (2019-11-01) and was included in the upstream 2.15.4 release before TuxCare onboarded it. Since the author (tatu.saloranta@iki.fi) is not a TuxCare/CloudLinux employee and the fix shipped in the upstream release, this is a vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability required adding two ehcache classes (GenericJndiSelector and GlassfishSelector) to the SubTypeValidator blocklist. These entries are present at lines 134-135 of SubTypeValidator.java. The fix was added by upstream maintainer Tatu Saloranta in commit fc4214a883d (2019-11-01) and was included in the upstream 2.15.4 release before TuxCare onboarded it. Since the author (tatu.saloranta@iki.fi) is not a TuxCare/CloudLinux employee and the fix shipped in the upstream release, this is a vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:58:57.863833+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects Jackson Databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta gadget classes. The target repository (jackson-databind 2.15.4-tuxcare.4) already contains the fix in SubTypeValidator.java at lines 157-160, which blocks deserialization of the three gadget classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider). The fix was authored by Tatu Saloranta (upstream maintainer) in commit a424c038ba and was already present in the upstream 2.15.4 release before TuxCare onboarded this version. Therefore, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects Jackson Databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta gadget classes. The target repository (jackson-databind 2.15.4-tuxcare.4) already contains the fix in SubTypeValidator.java at lines 157-160, which blocks deserialization of the three gadget classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider). The fix was authored by Tatu Saloranta (upstream maintainer) in commit a424c038ba and was already present in the upstream 2.15.4 release before TuxCare onboarded this version. Therefore, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 does not affect jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization of gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory. The upstream fix (commit 592872f4235c by Tatu Saloranta) blacklisted these classes in SubTypeValidator.java and was included in jackson-databind 2.10.4+. Since the target version 2.15.4 is much newer, the fix was already present in the upstream release that TuxCare onboarded (commit 8ebc175718). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 does not affect jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization of gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory. The upstream fix (commit 592872f4235c by Tatu Saloranta) blacklisted these classes in SubTypeValidator.java and was included in jackson-databind 2.10.4+. Since the target version 2.15.4 is much newer, the fix was already present in the upstream release that TuxCare onboarded (commit 8ebc175718). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability relates to deserialization gadget chains exploiting com.caucho.config.types.ResourceRef. The upstream fix (commit 1645efbd392989cf015f459a91c999e59c921b15 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.15.4 when TuxCare onboarded it (commit 8ebc175718f00bab78aeddca1350b96e4bbaa378). The target's SubTypeValidator.java line 167 contains the blocklist entry, and the validateSubType() method actively enforces the blocklist during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability relates to deserialization gadget chains exploiting com.caucho.config.types.ResourceRef. The upstream fix (commit 1645efbd392989cf015f459a91c999e59c921b15 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.15.4 when TuxCare onboarded it (commit 8ebc175718f00bab78aeddca1350b96e4bbaa378). The target's SubTypeValidator.java line 167 contains the blocklist entry, and the validateSubType() method actively enforces the blocklist during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is not present in this target. The vulnerability relates to jackson-databind's unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The fix (commit 05d7e0e13f) adding these classes to the SubTypeValidator blocklist was authored by upstream (Tatu Saloranta) and shipped in upstream release 2.15.4. TuxCare onboarded version 2.15.4 (commit 8ebc175718 - \"Onboard version 2.15.4\"), which already contained the fix. The vulnerable pattern was never present in any TuxCare-maintained version. The blocklist entries are confirmed present at SubTypeValidator.java:170-171, and the validateSubType method enforces the blocklist at runtime.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 is not present in this target. The vulnerability relates to jackson-databind's unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The fix (commit 05d7e0e13f) adding these classes to the SubTypeValidator blocklist was authored by upstream (Tatu Saloranta) and shipped in upstream release 2.15.4. TuxCare onboarded version 2.15.4 (commit 8ebc175718 - \"Onboard version 2.15.4\"), which already contained the fix. The vulnerable pattern was never present in any TuxCare-maintained version. The blocklist entries are confirmed present at SubTypeValidator.java:170-171, and the validateSubType method enforces the blocklist at runtime.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving javax.swing.JEditorPane. The target version 2.15.4-tuxcare.4 already contains the upstream fix committed by Tatu Saloranta on March 10, 2020 (commit 6ba4845798). The fix adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 150), which prevents deserialization of this dangerous class. This fix was already present in the upstream 2.15.4 release when TuxCare onboarded it (first TuxCare commit 8ebc175718), making this an upstream fix rather than a TuxCare backport. The defense is actively enforced - SubTypeValidator.validateSubType() is called during deserialization by BeanDeserializerFactory and will reject any attempt to deserialize javax.swing.JEditorPane with the error \"Illegal type (%s) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving javax.swing.JEditorPane. The target version 2.15.4-tuxcare.4 already contains the upstream fix committed by Tatu Saloranta on March 10, 2020 (commit 6ba4845798). The fix adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 150), which prevents deserialization of this dangerous class. This fix was already present in the upstream 2.15.4 release when TuxCare onboarded it (first TuxCare commit 8ebc175718), making this an upstream fix rather than a TuxCare backport. The defense is actively enforced - SubTypeValidator.validateSubType() is called during deserialization by BeanDeserializerFactory and will reject any attempt to deserialize javax.swing.JEditorPane with the error \"Illegal type (%s) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization gadgets in org.apache.activemq.* classes that could lead to arbitrary code execution. The fix (blocklist entries for activemq classes) was already present in the upstream 2.15.4 release that TuxCare onboarded, added by upstream maintainer Tatu Saloranta in commit c14c9f99ed. The target contains the complete defense in SubTypeValidator.java lines 173-183, which blocks all nine activemq classes identified in the CVE before any deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization gadgets in org.apache.activemq.* classes that could lead to arbitrary code execution. The fix (blocklist entries for activemq classes) was already present in the upstream 2.15.4 release that TuxCare onboarded, added by upstream maintainer Tatu Saloranta in commit c14c9f99ed. The target contains the complete defense in SubTypeValidator.java lines 173-183, which blocks all nine activemq classes identified in the CVE before any deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.4 is NOT affected by CVE-2020-11112. The vulnerability involved missing blocklist entries for deserialization gadget classes including org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (adding these classes to SubTypeValidator's blocklist) was implemented by upstream maintainer Tatu Saloranta in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 on 2020-03-25, first released in jackson-databind 2.9.10.4 and 2.10.4. The target's version 2.15.4 was onboarded by TuxCare with this upstream fix already present. The blocklist entry exists at line 186 of SubTypeValidator.java and successfully blocks deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target jackson-databind 2.15.4 is NOT affected by CVE-2020-11112. The vulnerability involved missing blocklist entries for deserialization gadget classes including org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (adding these classes to SubTypeValidator's blocklist) was implemented by upstream maintainer Tatu Saloranta in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 on 2020-03-25, first released in jackson-databind 2.9.10.4 and 2.10.4. The target's version 2.15.4 was onboarded by TuxCare with this upstream fix already present. The blocklist entry exists at line 186 of SubTypeValidator.java and successfully blocks deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns deserialization gadget org.apache.openjpa.ee.WASRegistryManagedRuntime, which was fixed in upstream version 2.9.10.4 (March 2020). The target version 2.15.4 (released 2023) already contains this fix as part of the upstream release. The fix commit (e2ba12d5d6) by Tatu Saloranta added WASRegistryManagedRuntime to the SubTypeValidator blocklist, preventing malicious deserialization. Since the fix was present in the upstream release 2.15.4 that TuxCare onboarded, the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns deserialization gadget org.apache.openjpa.ee.WASRegistryManagedRuntime, which was fixed in upstream version 2.9.10.4 (March 2020). The target version 2.15.4 (released 2023) already contains this fix as part of the upstream release. The fix commit (e2ba12d5d6) by Tatu Saloranta added WASRegistryManagedRuntime to the SubTypeValidator blocklist, preventing malicious deserialization. Since the fix was present in the upstream release 2.15.4 that TuxCare onboarded, the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entries for Spring Framework gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The target repository jackson-databind version 2.15.4 already contains the upstream fix (commit 113e89fb08) which adds these classes to the SubTypeValidator blacklist. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entries for Spring Framework gadget classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The target repository jackson-databind version 2.15.4 already contains the upstream fix (commit 113e89fb08) which adds these classes to the SubTypeValidator blacklist. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 concerns a deserialization gadget vulnerability in jackson-databind related to org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.15.4-tuxcare.4) is NOT AFFECTED because the upstream vendor fix is already present. The fix was authored by FasterXML maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 77040d85e3 and was shipped in upstream version 2.15.4, which TuxCare subsequently onboarded. The SubTypeValidator class at line 189 contains the blocklist entry \"org.apache.commons.jelly.impl.Embedded\", and the validateSubType method actively blocks deserialization of this class at runtime with a security error message.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 concerns a deserialization gadget vulnerability in jackson-databind related to org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.15.4-tuxcare.4) is NOT AFFECTED because the upstream vendor fix is already present. The fix was authored by FasterXML maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 77040d85e3 and was shipped in upstream version 2.15.4, which TuxCare subsequently onboarded. The SubTypeValidator class at line 189 contains the blocklist entry \"org.apache.commons.jelly.impl.Embedded\", and the validateSubType method actively blocks deserialization of this class at runtime with a security error message.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves unsafe deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit d1c67a0396) was included in the 2.15.4 release, adding this class and related classes to the SubTypeValidator blocklist at lines 191-195. The fix was authored by the upstream FasterXML maintainer and shipped in the upstream release before TuxCare's onboarding of version 2.15.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves unsafe deserialization of the gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit d1c67a0396) was included in the 2.15.4 release, adding this class and related classes to the SubTypeValidator blocklist at lines 191-195. The fix was authored by the upstream FasterXML maintainer and shipped in the upstream release before TuxCare's onboarding of version 2.15.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization gadgets using Oracle JMS connection factory classes (oracle.jms.AQjms*). The fix, which adds these five classes to the deserialization blacklist in SubTypeValidator.java, was already included in the upstream 2.15.4 release. The fix commit (5c8642aeae) was authored by upstream maintainer Tatu Saloranta and is present at HEAD (lines 200-204 of SubTypeValidator.java). The blacklist is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization gadgets using Oracle JMS connection factory classes (oracle.jms.AQjms*). The fix, which adds these five classes to the deserialization blacklist in SubTypeValidator.java, was already included in the upstream 2.15.4 release. The fix commit (5c8642aeae) was authored by upstream maintainer Tatu Saloranta and is present at HEAD (lines 200-204 of SubTypeValidator.java). The blacklist is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target is running version 2.15.4-tuxcare.4, which is significantly newer. The upstream vendor (FasterXML) fixed this vulnerability by adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to SubTypeValidator's deserialization blocklist in commit 840eae2 (May 2020). This fix was already present in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the upstream fix shipped before version 2.15.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target is running version 2.15.4-tuxcare.4, which is significantly newer. The upstream vendor (FasterXML) fixed this vulnerability by adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to SubTypeValidator's deserialization blocklist in commit 840eae2 (May 2020). This fix was already present in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the upstream fix shipped before version 2.15.4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.4-tuxcare.4 is not affected by CVE-2020-14195. The vulnerability involves deserialization of the malicious class org.jsecurity.realm.jndi.JndiRealmFactory which can lead to arbitrary code execution via JNDI injection. The upstream fix (commit f6d9c664f6 by tatu.saloranta@iki.fi) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was shipped in upstream version 2.9.10.5 and is present in all subsequent versions including the upstream 2.15.4 release that TuxCare onboarded. The vulnerable code pattern is therefore not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "Target version 2.15.4-tuxcare.4 is not affected by CVE-2020-14195. The vulnerability involves deserialization of the malicious class org.jsecurity.realm.jndi.JndiRealmFactory which can lead to arbitrary code execution via JNDI injection. The upstream fix (commit f6d9c664f6 by tatu.saloranta@iki.fi) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was shipped in upstream version 2.9.10.5 and is present in all subsequent versions including the upstream 2.15.4 release that TuxCare onboarded. The vulnerable code pattern is therefore not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:28.173576+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a missing blocklist entry for the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository is jackson-databind 2.15.4-tuxcare.4, which already contains the upstream fix. The blocklist entry was added in upstream commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 by maintainer Tatu Saloranta and shipped with the upstream 2.15.4 release that TuxCare onboarded. The fix is present at line 147 of SubTypeValidator.java and is actively enforced during bean deserialization through BeanDeserializerFactory, preventing instantiation of this dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a missing blocklist entry for the deserialization gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository is jackson-databind 2.15.4-tuxcare.4, which already contains the upstream fix. The blocklist entry was added in upstream commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 by maintainer Tatu Saloranta and shipped with the upstream 2.15.4 release that TuxCare onboarded. The fix is present at line 147 of SubTypeValidator.java and is actively enforced during bean deserialization through BeanDeserializerFactory, preventing instantiation of this dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:15.914422+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.4-tuxcare.4 is NOT affected by CVE-2020-24750. The dangerous gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is already blocked in the deserialization blocklist (SubTypeValidator.java line 210). This fix was introduced by upstream maintainer Tatu Saloranta in July 2020 and was already present in the upstream 2.15.4 release before TuxCare onboarded it. The CVE affects versions before 2.6.7.5 and 2.7.x before 2.9.10.6, while the target is version 2.15.4, which is significantly newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "The target repository jackson-databind version 2.15.4-tuxcare.4 is NOT affected by CVE-2020-24750. The dangerous gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration is already blocked in the deserialization blocklist (SubTypeValidator.java line 210). This fix was introduced by upstream maintainer Tatu Saloranta in July 2020 and was already present in the upstream 2.15.4 release before TuxCare onboarded it. The CVE affects versions before 2.6.7.5 and 2.7.x before 2.9.10.6, while the target is version 2.15.4, which is significantly newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in XML deserialization) is NOT present in jackson-databind 2.15.4-tuxcare.4. The fix for this vulnerability was included in upstream Jackson 2.11.0 (released October 2020) and is present in the target version 2.15.4 (released later). The fix adds two XML parser security features to DOMDeserializer.java: disallow-doctype-decl=true and load-external-dtd=false. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in XML deserialization) is NOT present in jackson-databind 2.15.4-tuxcare.4. The fix for this vulnerability was included in upstream Jackson 2.11.0 (released October 2020) and is present in the target version 2.15.4 (released later). The fix adds two XML parser security features to DOMDeserializer.java: disallow-doctype-decl=true and load-external-dtd=false. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:19:24.952513+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.4-tuxcare.4 is NOT affected by CVE-2020-35490. The upstream fix (commit 41b8bdb5) that blocks deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream 2.15.4 release when TuxCare onboarded it. The blocklist entries are confirmed at SubTypeValidator.java lines 217-218, and the validation is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target jackson-databind version 2.15.4-tuxcare.4 is NOT affected by CVE-2020-35490. The upstream fix (commit 41b8bdb5) that blocks deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream 2.15.4 release when TuxCare onboarded it. The blocklist entries are confirmed at SubTypeValidator.java lines 217-218, and the validation is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind 2.x before 2.9.10.8. The target version 2.15.4-tuxcare.4 already contains the upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, Dec 2020) that adds org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the SubTypeValidator blocklist. The fix was shipped in the upstream 2.15.4 release before TuxCare onboarded it, so the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 affects jackson-databind 2.x before 2.9.10.8. The target version 2.15.4-tuxcare.4 already contains the upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, Dec 2020) that adds org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the SubTypeValidator blocklist. The fix was shipped in the upstream 2.15.4 release before TuxCare onboarded it, so the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:53:26.160394+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that enables JNDI injection attacks. The target repository is at version 2.15.4-tuxcare.4, which already contains the upstream fix. The gadget class was added to the DEFAULT_NO_DESER_CLASS_NAMES blacklist by upstream commit 1ca0388c2fb (authored by Tatu Saloranta on 2020-12-26), which was included in the upstream release 2.15.4 before TuxCare's onboarding. Any attempt to deserialize this class is blocked by SubTypeValidator with the error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) that enables JNDI injection attacks. The target repository is at version 2.15.4-tuxcare.4, which already contains the upstream fix. The gadget class was added to the DEFAULT_NO_DESER_CLASS_NAMES blacklist by upstream commit 1ca0388c2fb (authored by Tatu Saloranta on 2020-12-26), which was included in the upstream release 2.15.4 before TuxCare's onboarding. Any attempt to deserialize this class is blocked by SubTypeValidator with the error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:21:55.137725+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, related to the deserialization gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The target is version 2.15.4-tuxcare.4, which already contains the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta, dated 2020-12-31). The fix adds the gadget class to SubTypeValidator's blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing its deserialization. This fix was included in the upstream 2.15.4 release when TuxCare onboarded it (first TuxCare commit: 8ebc175718f00bab78aeddca1350b96e4bbaa378 \"Onboard version 2.15.4\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, related to the deserialization gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The target is version 2.15.4-tuxcare.4, which already contains the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta, dated 2020-12-31). The fix adds the gadget class to SubTypeValidator's blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing its deserialization. This fix was included in the upstream 2.15.4 release when TuxCare onboarded it (first TuxCare commit: 8ebc175718f00bab78aeddca1350b96e4bbaa378 \"Onboard version 2.15.4\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:33:21.899203+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.15.4. The vulnerability relates to missing blocklist entries for DriverAdapterCPDS gadget classes that could enable deserialization attacks. The fix (commit 3ded28aece) was applied by upstream maintainer Tatu Saloranta on December 31, 2020, adding five DriverAdapterCPDS variants to the SubTypeValidator denylist. This fix was already present in the upstream jackson-databind 2.15.4 release that TuxCare onboarded on September 10, 2026. All five gadget classes are correctly blocked in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.15.4. The vulnerability relates to missing blocklist entries for DriverAdapterCPDS gadget classes that could enable deserialization attacks. The fix (commit 3ded28aece) was applied by upstream maintainer Tatu Saloranta on December 31, 2020, adding five DriverAdapterCPDS variants to the SubTypeValidator denylist. This fix was already present in the upstream jackson-databind 2.15.4 release that TuxCare onboarded on September 10, 2026. All five gadget classes are correctly blocked in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:40:07.551074+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, relating to deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS gadget class. The target repository is jackson-databind version 2.15.4-tuxcare.4. The fix for this vulnerability (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable class name is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 228, 234), preventing its deserialization. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, relating to deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS gadget class. The target repository is jackson-databind version 2.15.4-tuxcare.4. The fix for this vulnerability (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable class name is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 228, 234), preventing its deserialization. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:11:01.674474+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.4-tuxcare.4 is NOT affected by CVE-2020-36182. The vulnerability concerns a Jackson deserialization gadget (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) that allows remote code execution via polymorphic type handling. The upstream fix was committed by Tatu Saloranta (tatu.saloranta@iki.fi) on December 31, 2020 (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b), first released in jackson-databind 2.9.10.8. This fix was already present in the upstream 2.15.4 release that TuxCare onboarded, as confirmed by the gadget class being in SubTypeValidator.java's blacklist at line 234 in HEAD (5cc134ff61d000f2203329cc2df71c77ce8107ad). The CVE states it affects versions BEFORE 2.9.10.8; version 2.15.4 is much newer and includes the defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "Target version 2.15.4-tuxcare.4 is NOT affected by CVE-2020-36182. The vulnerability concerns a Jackson deserialization gadget (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS) that allows remote code execution via polymorphic type handling. The upstream fix was committed by Tatu Saloranta (tatu.saloranta@iki.fi) on December 31, 2020 (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b), first released in jackson-databind 2.9.10.8. This fix was already present in the upstream 2.15.4 release that TuxCare onboarded, as confirmed by the gadget class being in SubTypeValidator.java's blacklist at line 234 in HEAD (5cc134ff61d000f2203329cc2df71c77ce8107ad). The CVE states it affects versions BEFORE 2.9.10.8; version 2.15.4 is much newer and includes the defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:07.841451+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns a JNDI injection gadget class (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that was blocked from deserialization by upstream fix commit 12e23c962f on 2020-12-31. This fix was already included in the upstream 2.15.4 release (prepared 2024-02-15) that TuxCare later onboarded. The blocklist entry is present in SubTypeValidator.java at line 243, preventing exploitation of this gadget chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns a JNDI injection gadget class (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that was blocked from deserialization by upstream fix commit 12e23c962f on 2020-12-31. This fix was already included in the upstream 2.15.4 release (prepared 2024-02-15) that TuxCare later onboarded. The blocklist entry is present in SubTypeValidator.java at line 243, preventing exploitation of this gadget chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The target version 2.15.4-tuxcare.4 already contains the upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) that adds these gadget classes to the SubTypeValidator denylist. The fix was present in the upstream release 2.15.4 and was subsequently onboarded by TuxCare via commit 8ebc175718. The vulnerable code pattern is not present because the upstream vendor already shipped the fix in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. The target version 2.15.4-tuxcare.4 already contains the upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) that adds these gadget classes to the SubTypeValidator denylist. The fix was present in the upstream release 2.15.4 and was subsequently onboarded by TuxCare via commit 8ebc175718. The vulnerable code pattern is not present because the upstream vendor already shipped the fix in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:03:43.787457+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.4-tuxcare.4) is NOT AFFECTED by CVE-2020-36185. The vulnerability affects jackson-databind 2.x before 2.9.10.8, but the target version 2.15.4 is significantly newer and already contains the upstream fix. The fix (commit 567194c53ae by Tatu Saloranta, 2020-12-26) adds blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to prevent deserialization gadget attacks. This fix was included in upstream release 2.12.1 and all subsequent versions, including 2.15.4, before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "The target repository (jackson-databind 2.15.4-tuxcare.4) is NOT AFFECTED by CVE-2020-36185. The vulnerability affects jackson-databind 2.x before 2.9.10.8, but the target version 2.15.4 is significantly newer and already contains the upstream fix. The fix (commit 567194c53ae by Tatu Saloranta, 2020-12-26) adds blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to prevent deserialization gadget attacks. This fix was included in upstream release 2.12.1 and all subsequent versions, including 2.15.4, before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:28:16.587354+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.4-tuxcare.4 is not affected by CVE-2020-36186. The upstream fix (commit 3e8fa3beea4 by Tatu Saloranta) that adds blocklist entries for org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream release 2.15.4, which TuxCare onboarded. The vulnerable deserialization gadget classes are blocked at lines 229-230 of SubTypeValidator.java, preventing exploitation of the gadget chain described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target jackson-databind version 2.15.4-tuxcare.4 is not affected by CVE-2020-36186. The upstream fix (commit 3e8fa3beea4 by Tatu Saloranta) that adds blocklist entries for org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream release 2.15.4, which TuxCare onboarded. The vulnerable deserialization gadget classes are blocked at lines 229-230 of SubTypeValidator.java, preventing exploitation of the gadget chain described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:42:56.737779+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, Dec 2020) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream release 2.15.4 when TuxCare onboarded the version in Sep 2026. The target is not affected because the vulnerable pattern is absent - the upstream vendor fixed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, Dec 2020) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream release 2.15.4 when TuxCare onboarded the version in Sep 2026. The target is not affected because the vulnerable pattern is absent - the upstream vendor fixed it before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.15.4. The vulnerability relates to unsafe deserialization of specific gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that could lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 33d96c13fe by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was included in upstream release 2.9.10.8 and is present in version 2.15.4, which TuxCare onboarded. The blocklist is enforced during bean deserialization and throws \"Illegal type to deserialize: prevented for security reasons\" when these classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.15.4. The vulnerability relates to unsafe deserialization of specific gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that could lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 33d96c13fe by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was included in upstream release 2.9.10.8 and is present in version 2.15.4, which TuxCare onboarded. The blocklist is enforced during bean deserialization and throws \"Illegal type to deserialize: prevented for security reasons\" when these classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not exploitable in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource. The upstream vendor (FasterXML) fixed this in version 2.9.10.8 (commit 33d96c13fe by tatu.saloranta@iki.fi on 2020-12-26) by adding these classes to the SubTypeValidator blacklist. The target version 2.15.4 includes this upstream fix, preventing instantiation of the vulnerable gadget classes during polymorphic deserialization. The fix was shipped in the upstream release, not added by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is not exploitable in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource. The upstream vendor (FasterXML) fixed this in version 2.9.10.8 (commit 33d96c13fe by tatu.saloranta@iki.fi on 2020-12-26) by adding these classes to the SubTypeValidator blacklist. The target version 2.15.4 includes this upstream fix, preventing instantiation of the vulnerable gadget classes during polymorphic deserialization. The fix was shipped in the upstream release, not added by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:15:24.867676+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.4 is not affected by CVE-2020-36518. The upstream vendor (FasterXML) fixed this vulnerability in version 2.14.0 by replacing the recursive UntypedObjectDeserializer.Vanilla implementation with a non-recursive UntypedObjectDeserializerNR implementation (commit 8238ab41d0). This fix shipped in the upstream 2.15.4 release. The non-recursive implementation prevents stack overflow by using iteration with Scope objects instead of recursive method calls, eliminating the attack vector. The vulnerable recursive code path is deprecated and not reachable in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "The target jackson-databind 2.15.4 is not affected by CVE-2020-36518. The upstream vendor (FasterXML) fixed this vulnerability in version 2.14.0 by replacing the recursive UntypedObjectDeserializer.Vanilla implementation with a non-recursive UntypedObjectDeserializerNR implementation (commit 8238ab41d0). This fix shipped in the upstream 2.15.4 release. The non-recursive implementation prevents stack overflow by using iteration with Scope objects instead of recursive method calls, eliminating the attack vector. The vulnerable recursive code path is deprecated and not reachable in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns the lack of blocking for org.apache.xbean.propertyeditor.JndiConverter, a JNDI-capable gadget class exploitable via polymorphic deserialization. The upstream fix (commit 914e7c9f by Tatu Saloranta, Feb 2020) added JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.15.4 release when TuxCare onboarded it. The blocking code is confirmed at line 138 of SubTypeValidator.java and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability concerns the lack of blocking for org.apache.xbean.propertyeditor.JndiConverter, a JNDI-capable gadget class exploitable via polymorphic deserialization. The upstream fix (commit 914e7c9f by Tatu Saloranta, Feb 2020) added JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.15.4 release when TuxCare onboarded it. The blocking code is confirmed at line 138 of SubTypeValidator.java and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.4-tuxcare.4 is not affected by CVE-2020-9546. The vulnerability (deserialization gadget org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) was fixed by upstream vendor Tatu Saloranta in commit 1e64db6a2f, which was already present in the upstream 2.15.4 release before TuxCare onboarded it. The blocklist entry at SubTypeValidator.java:141 prevents instantiation of the gadget class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "Target jackson-databind 2.15.4-tuxcare.4 is not affected by CVE-2020-9546. The vulnerability (deserialization gadget org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) was fixed by upstream vendor Tatu Saloranta in commit 1e64db6a2f, which was already present in the upstream 2.15.4 release before TuxCare onboarded it. The blocklist entry at SubTypeValidator.java:141 prevents instantiation of the gadget class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:37:21.976714+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2020-9547. The upstream fix that blocks deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig was already included in the upstream 2.15.4 release. The CVE affects versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7; version 2.15.4 is significantly newer and contains the fix. The fix commit (1e64db6a2fad331f96c7363fda3bc5f3dffa25bb) by upstream author tatu.saloranta@iki.fi predates TuxCare's onboarding commit (8ebc175718f00bab78aeddca1350b96e4bbaa378) for version 2.15.4. The vulnerable code pattern does not exist in the target because the upstream vendor already removed it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "Target jackson-databind version 2.15.4-tuxcare.4 is NOT AFFECTED by CVE-2020-9547. The upstream fix that blocks deserialization of com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig was already included in the upstream 2.15.4 release. The CVE affects versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7; version 2.15.4 is significantly newer and contains the fix. The fix commit (1e64db6a2fad331f96c7363fda3bc5f3dffa25bb) by upstream author tatu.saloranta@iki.fi predates TuxCare's onboarding commit (8ebc175718f00bab78aeddca1350b96e4bbaa378) for version 2.15.4. The vulnerable code pattern does not exist in the target because the upstream vendor already removed it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions that lack blocklist protection for br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.15.4) contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions that lack blocklist protection for br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.15.4) contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.15.4 release that TuxCare onboarded. The vulnerable deserialization pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:09:27.722120+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization of dangerous gadget classes (javax.swing.JTextPane and others) that can lead to arbitrary code execution. The fix, which blocklists these classes in SubTypeValidator, was already present in upstream version 2.15.4 before TuxCare onboarded it. The blocklist is actively enforced during deserialization via BeanDeserializerFactory. Fix commit 7dbf51bf78 by upstream maintainer Tatu Saloranta predates TuxCare's onboarding commit 8ebc175718.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.15.4-tuxcare.4. The vulnerability involves deserialization of dangerous gadget classes (javax.swing.JTextPane and others) that can lead to arbitrary code execution. The fix, which blocklists these classes in SubTypeValidator, was already present in upstream version 2.15.4 before TuxCare onboarded it. The blocklist is actively enforced during deserialization via BeanDeserializerFactory. Fix commit 7dbf51bf78 by upstream maintainer Tatu Saloranta predates TuxCare's onboarding commit 8ebc175718.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.4-tuxcare.4 is NOT affected by CVE-2021-46877. The vulnerability (excessive heap allocation DoS via malicious JDK serialization data) was fixed by upstream maintainer Tatu Saloranta in commit 3ccde7d938 (Dec 2021). This fix shipped in upstream release 2.15.4 (May 2023) before TuxCare onboarded it. The vulnerable code pattern is not present in the target - the defensive incremental reading logic with 100k allocation limit is in place at src/main/java/com/fasterxml/jackson/databind/node/NodeSerialization.java lines 17-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "The target jackson-databind 2.15.4-tuxcare.4 is NOT affected by CVE-2021-46877. The vulnerability (excessive heap allocation DoS via malicious JDK serialization data) was fixed by upstream maintainer Tatu Saloranta in commit 3ccde7d938 (Dec 2021). This fix shipped in upstream release 2.15.4 (May 2023) before TuxCare onboarded it. The vulnerable code pattern is not present in the target - the defensive incremental reading logic with 100k allocation limit is in place at src/main/java/com/fasterxml/jackson/databind/node/NodeSerialization.java lines 17-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:38.207193+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.15.4 is not affected by CVE-2022-42003. The vulnerability affects versions 2.4.0-rc1 until 2.12.7.1 and 2.13.x before 2.13.4.2. The fix was introduced in upstream commits cd090979 and d78d00ee by upstream authors (Cesar Hernandez and Tatu Saloranta) and was already present in the upstream 2.15.4 release that TuxCare onboarded. The defense code that prevents deep nested array processing when UNWRAP_SINGLE_VALUE_ARRAYS is enabled is present in both StdDeserializer.java and BeanDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "The target jackson-databind version 2.15.4 is not affected by CVE-2022-42003. The vulnerability affects versions 2.4.0-rc1 until 2.12.7.1 and 2.13.x before 2.13.4.2. The fix was introduced in upstream commits cd090979 and d78d00ee by upstream authors (Cesar Hernandez and Tatu Saloranta) and was already present in the upstream 2.15.4 release that TuxCare onboarded. The defense code that prevents deep nested array processing when UNWRAP_SINGLE_VALUE_ARRAYS is enabled is present in both StdDeserializer.java and BeanDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:57:07.115751+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta, which shipped in the upstream 2.15.4 release before TuxCare's onboarding. The fix adds a check in BeanDeserializer._deserializeFromArray() (lines 638-646) that rejects any second START_ARRAY token when unwrapping, preventing nested arrays like [[...]] from causing unbounded processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.15.4-tuxcare.4. The vulnerability (resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta, which shipped in the upstream 2.15.4 release before TuxCare's onboarding. The fix adds a check in BeanDeserializer._deserializeFromArray() (lines 638-646) that rejects any second START_ARRAY token when unwrapping, preventing nested arrays like [[...]] from causing unbounded processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:24:00.208489+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:17:50.706643+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 is NOT PRESENT in jackson-databind 2.15.4. The vulnerability (StackOverflowError from deeply nested JSON via JsonNode.toString()) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec authored by Tatu Saloranta. The fix replaced recursive tree traversal with iterative traversal using an explicit IteratorStack. This upstream fix shipped in the 2.15.4 release that TuxCare onbo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 is NOT PRESENT in jackson-databind 2.15.4. The vulnerability (StackOverflowError from deeply nested JSON via JsonNode.toString()) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec authored by Tatu Saloranta. The fix replaced recursive tree traversal with iterative traversal using an explicit IteratorStack. This upstream fix shipped in the 2.15.4 release that TuxCare onbo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:28:26.184111+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:28:26.184111+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:52:00.056307+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:25:57.000889+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.15.4 is NOT affected by CVE-2026-54517. While the target code contains the missing @JsonView check in the regular-property buffering path (BeanDeserializer.java lines 467-489), the routing mechanism that sends setterless collection/map properties through this vulnerable path does not exist in 2.15.4. The bufferMergingProperty() method required to route setterless properties thr...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Target version 2.15.4 is NOT affected by CVE-2026-54517. While the target code contains the missing @JsonView check in the regular-property buffering path (BeanDeserializer.java lines 467-489), the routing mechanism that sends setterless collection/map properties through this vulnerable path does not exist in 2.15.4. The bufferMergingProperty() method required to route setterless properties thr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:00:46.216689+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.15.4 is not affected by CVE-2026-54518. The vulnerability requires the combination of @JsonUnwrapped with @JsonCreator, which is explicitly prohibited in this version. The vulnerable code path (UnwrappedPropertyHandler.processUnwrappedCreatorProperties method) does not exist. This feature was only implemented in version 2.19.0 (November 2024), well after the 2.15.4 release (February 2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.15.4 is not affected by CVE-2026-54518. The vulnerability requires the combination of @JsonUnwrapped with @JsonCreator, which is explicitly prohibited in this version. The vulnerable code path (UnwrappedPropertyHandler.processUnwrappedCreatorProperties method) does not exist. This feature was only implemented in version 2.19.0 (November 2024), well after the 2.15.4 release (February 2..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:11:20.444722+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:12:00.189875+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:25:18.148187+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:12:00.189875+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:12:00.189875+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:28:26.184111+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      },
      "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.15.4-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.15.4-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}