{
  "@id": "urn:uuid:e861eec4-3232-490a-8c5e-93a06aba47b1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:14:22.471817+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 (jackson-databind #1737) is NOT present in version 2.16.1. The vulnerability required blacklisting additional dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, com.mchange.v2.c3p0.JndiRefForwardingDataSource, com.mchange.v2.c3p0.WrapperConnectionPoolDataSource) to prevent deserialization-based code execution. All these classes are already blacklisted in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES in the target version. The fix was introduced in upstream jackson-databind by commit ddfddfba64 (authored by Tatu Saloranta) and shipped in the upstream 2.16.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 (jackson-databind #1737) is NOT present in version 2.16.1. The vulnerability required blacklisting additional dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.springframework.beans.factory.config.PropertyPathFactoryBean, com.mchange.v2.c3p0.JndiRefForwardingDataSource, com.mchange.v2.c3p0.WrapperConnectionPoolDataSource) to prevent deserialization-based code execution. All these classes are already blacklisted in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES in the target version. The fix was introduced in upstream jackson-databind by commit ddfddfba64 (authored by Tatu Saloranta) and shipped in the upstream 2.16.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.1-tuxcare.3 is NOT affected by CVE-2017-17485. The upstream FasterXML jackson-databind 2.16.1 release (onboarded by TuxCare) already contains comprehensive fixes for this vulnerability. The SubTypeValidator class includes: (1) blacklist entries for all CVE-2017-17485 gadgets (Spring PropertyPathFactoryBean, MethodLocatingFactoryBean, BeanReferenceFactoryBean; Tomcat DBCP BasicDataSource; JDK FileHandler, UnicastRemoteObject; BCEL ClassLoader), (2) special hierarchy checks blocking any subclass of AbstractPointcutAdvisor or AbstractApplicationContext, and (3) C3P0 DataSource pattern matching. The validator is integrated at BeanDeserializerFactory:141, called before deserialization logic executes. Fixes #1737 (ddfddfba64) and #1855 (2235894210) by tatu.saloranta@iki.fi are ancestors of the onboarding commit, confirming they shipped in upstream 2.16.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target version 2.16.1-tuxcare.3 is NOT affected by CVE-2017-17485. The upstream FasterXML jackson-databind 2.16.1 release (onboarded by TuxCare) already contains comprehensive fixes for this vulnerability. The SubTypeValidator class includes: (1) blacklist entries for all CVE-2017-17485 gadgets (Spring PropertyPathFactoryBean, MethodLocatingFactoryBean, BeanReferenceFactoryBean; Tomcat DBCP BasicDataSource; JDK FileHandler, UnicastRemoteObject; BCEL ClassLoader), (2) special hierarchy checks blocking any subclass of AbstractPointcutAdvisor or AbstractApplicationContext, and (3) C3P0 DataSource pattern matching. The validator is integrated at BeanDeserializerFactory:141, called before deserialization logic executes. Fixes #1737 (ddfddfba64) and #1855 (2235894210) by tatu.saloranta@iki.fi are ancestors of the onboarding commit, confirming they shipped in upstream 2.16.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.1-tuxcare.3 is NOT affected by CVE-2017-7525. The vulnerability (polymorphic deserialization allowing arbitrary code execution via dangerous classes like TemplatesImpl) is mitigated by SubTypeValidator, which maintains a blocklist of known gadget classes and validates all bean deserialization requests. The fix was already present in upstream release 2.16.1, authored by Tatu Saloranta (upstream maintainer), before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target jackson-databind version 2.16.1-tuxcare.3 is NOT affected by CVE-2017-7525. The vulnerability (polymorphic deserialization allowing arbitrary code execution via dangerous classes like TemplatesImpl) is mitigated by SubTypeValidator, which maintains a blocklist of known gadget classes and validates all bean deserialization requests. The fix was already present in upstream release 2.16.1, authored by Tatu Saloranta (upstream maintainer), before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 (iBatis XPathParser deserialization gadget) is NOT present in jackson-databind 2.16.1-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability by adding \"org.apache.ibatis.parsing.XPathParser\" to the blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.16.1 when TuxCare onboarded it. The blacklist entry exists at line 65 of SubTypeValidator.java and is enforced during bean deserialization at BeanDeserializerFactory:141, blocking any attempt to deserialize the dangerous iBatis class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 (iBatis XPathParser deserialization gadget) is NOT present in jackson-databind 2.16.1-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability by adding \"org.apache.ibatis.parsing.XPathParser\" to the blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.16.1 when TuxCare onboarded it. The blacklist entry exists at line 65 of SubTypeValidator.java and is enforced during bean deserialization at BeanDeserializerFactory:141, blocking any attempt to deserialize the dangerous iBatis class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.16.1-tuxcare.3 includes the upstream fix that was already present in the 2.16.1 release. The fix adds three class names (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blocklist to prevent polymorphic deserialization attacks via LDAP/JNDI. Git ancestry analysis confirms the fix commit (28badf7ef60a) was authored by upstream maintainer Tatu Saloranta and was included in the upstream release before TuxCare onboarded version 2.16.1 (commit 5b558ba85a). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.16.1-tuxcare.3 includes the upstream fix that was already present in the 2.16.1 release. The fix adds three class names (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blocklist to prevent polymorphic deserialization attacks via LDAP/JNDI. Git ancestry analysis confirms the fix commit (28badf7ef60a) was authored by upstream maintainer Tatu Saloranta and was included in the upstream release before TuxCare onboarded version 2.16.1 (commit 5b558ba85a). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.16.1. The vulnerability pattern (Oracle JDBC classes exploitable via JNDI/LDAP during polymorphic deserialization) was fixed in upstream release 2.7.9.4 (June 2018) by adding oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix is present in the target at SubTypeValidator.java lines 70-72 and was included in the upstream 2.16.1 release that TuxCare onboarded. The fix commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a by upstream author tatu.saloranta@iki.fi is an ancestor of the 2.16.1 onboarding commit, confirming this is an upstream fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.16.1. The vulnerability pattern (Oracle JDBC classes exploitable via JNDI/LDAP during polymorphic deserialization) was fixed in upstream release 2.7.9.4 (June 2018) by adding oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix is present in the target at SubTypeValidator.java lines 70-72 and was included in the upstream 2.16.1 release that TuxCare onboarded. The fix commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a by upstream author tatu.saloranta@iki.fi is an ancestor of the 2.16.1 onboarding commit, confirming this is an upstream fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.1-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The vulnerability concerns polymorphic deserialization of the slf4j-ext class org.slf4j.ext.EventData, which could enable arbitrary code execution. The upstream vendor fix (commit 87d29af25e by Tatu Saloranta) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. In jackson-databind 2.16.1, this protection exists in SubTypeValidator.java at line 75, where the class is blocked from deserialization. The fix was already present in the upstream 2.16.1 release that TuxCare onboarded (commit 5b558ba85a), meaning the vulnerable pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target repository (jackson-databind 2.16.1-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The vulnerability concerns polymorphic deserialization of the slf4j-ext class org.slf4j.ext.EventData, which could enable arbitrary code execution. The upstream vendor fix (commit 87d29af25e by Tatu Saloranta) added org.slf4j.ext.EventData to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. In jackson-databind 2.16.1, this protection exists in SubTypeValidator.java at line 75, where the class is blocked from deserialization. The fix was already present in the upstream 2.16.1 release that TuxCare onboarded (commit 5b558ba85a), meaning the vulnerable pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for blaze-ds classes in polymorphic deserialization. The target version 2.16.1-tuxcare.3 already contains the upstream fix - the blaze-ds class 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:76. This fix was included in upstream release 2.16.1 and brought into the TuxCare repository via the onboarding commit. The vulnerable code pattern (missing blaze-ds blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for blaze-ds classes in polymorphic deserialization. The target version 2.16.1-tuxcare.3 already contains the upstream fix - the blaze-ds class 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:76. This fix was included in upstream release 2.16.1 and brought into the TuxCare repository via the onboarding commit. The vulnerable code pattern (missing blaze-ds blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability allows XXE/deserialization attacks through four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The fix blocking these classes was applied by upstream FasterXML in commit 87d29af25e (Aug 2018) and shipped in version 2.9.7. Target version 2.16.1 (released 2023) inherits this fix - all four classes are blocked in SubTypeValidator.java lines 75-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "Target jackson-databind 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability allows XXE/deserialization attacks through four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The fix blocking these classes was applied by upstream FasterXML in commit 87d29af25e (Aug 2018) and shipped in version 2.9.7. Target version 2.16.1 (released 2023) inherits this fix - all four classes are blocked in SubTypeValidator.java lines 75-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.16.1-tuxcare.3. The fix for this vulnerability was already included in the upstream release 2.16.1 before TuxCare onboarding. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked from polymorphic deserialization via SubTypeValidator's blacklist (line 78), which is actively enforced by BeanDeserializerFactory. The fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 authored by upstream maintainer Tatu Saloranta in August 2018 is an ancestor of HEAD and predates TuxCare's onboarding commit by years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.16.1-tuxcare.3. The fix for this vulnerability was already included in the upstream release 2.16.1 before TuxCare onboarding. The dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl is blocked from polymorphic deserialization via SubTypeValidator's blacklist (line 78), which is actively enforced by BeanDeserializerFactory. The fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 authored by upstream maintainer Tatu Saloranta in August 2018 is an ancestor of HEAD and predates TuxCare's onboarding commit by years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 concerns jackson-databind's failure to block the org.apache.axis2.transport.jms.JMSOutTransportInfo class from polymorphic deserialization, allowing attackers to potentially execute arbitrary code. The target repository (jackson-databind 2.16.1-tuxcare.2) contains the upstream fix that adds this class to the deserialization blocklist. The fix (commit 72cd4025a2, \"Fix #2186\") was authored by Tatu Saloranta and was already present in the upstream 2.16.1 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 concerns jackson-databind's failure to block the org.apache.axis2.transport.jms.JMSOutTransportInfo class from polymorphic deserialization, allowing attackers to potentially execute arbitrary code. The target repository (jackson-databind 2.16.1-tuxcare.2) contains the upstream fix that adds this class to the deserialization blocklist. The fix (commit 72cd4025a2, \"Fix #2186\") was authored by Tatu Saloranta and was already present in the upstream 2.16.1 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2018-19361. The upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a2 by adding org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the polymorphic deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.16.1 before TuxCare onboarded it (commit 5b558ba8). The blocklist entries are confirmed present at lines 82-83 of SubTypeValidator.java, and the validation enforcement is active in the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "Target jackson-databind 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2018-19361. The upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a2 by adding org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the polymorphic deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.16.1 before TuxCare onboarded it (commit 5b558ba8). The blocklist entries are confirmed present at lines 82-83 of SubTypeValidator.java, and the validation enforcement is active in the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8. The target repository is jackson-databind 2.16.1-tuxcare.3, which is significantly newer. The vulnerability involves missing blacklist entries for dangerous classes (specifically org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core) in polymorphic deserialization. The upstream vendor fix (commit 72cd4025a2 by Tatu Saloranta) added these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was already present in upstream release 2.16.1 when TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8. The target repository is jackson-databind 2.16.1-tuxcare.3, which is significantly newer. The vulnerability involves missing blacklist entries for dangerous classes (specifically org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core) in polymorphic deserialization. The upstream vendor fix (commit 72cd4025a2 by Tatu Saloranta) added these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was already present in upstream release 2.16.1 when TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3. The target version 2.16.1-tuxcare.3 is not affected because the upstream fix (adding org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist) was already included in the upstream 2.16.1 release from December 2023. The fix was committed upstream in January 2018 (commit 038b471e2e by tatu.saloranta@iki.fi) and shipped with version 2.16.1 before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3. The target version 2.16.1-tuxcare.3 is not affected because the upstream fix (adding org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist) was already included in the upstream 2.16.1 release from December 2023. The fix was committed upstream in January 2018 (commit 038b471e2e by tatu.saloranta@iki.fi) and shipped with version 2.16.1 before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target is not affected by CVE-2018-7489. The upstream fix (commit 6799f8f10c, authored by Tatu Saloranta on 2018-02-10) that blocks deserialization of c3p0 DataSource gadget classes is present in the target codebase. The fix extends the blacklist validation in SubTypeValidator.java to reject ALL classes matching the pattern com.mchange.v2.c3p0.*DataSource (lines 288-297), preventing the incomplete-blacklist bypass described in the CVE. This fix shipped in upstream release 2.16.1, which TuxCare onboarded at commit 5b558ba85a. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target is not affected by CVE-2018-7489. The upstream fix (commit 6799f8f10c, authored by Tatu Saloranta on 2018-02-10) that blocks deserialization of c3p0 DataSource gadget classes is present in the target codebase. The fix extends the blacklist validation in SubTypeValidator.java to reject ALL classes matching the pattern com.mchange.v2.c3p0.*DataSource (lines 288-297), preventing the incomplete-blacklist bypass described in the CVE. This fix shipped in upstream release 2.16.1, which TuxCare onboarded at commit 5b558ba85a. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2019-12086. The fix that adds com.mysql.cj.jdbc.admin.MiniAdmin to the polymorphic deserialization blocklist is already present in SubTypeValidator.java line 88. This fix was introduced by upstream maintainer Tatu Saloranta in commit dda513bd72, which predates the first TuxCare commit in HEAD's ancestry (a7a5ae30fc), confirming it was already included in the upstream release that TuxCare onboarded. The vulnerable pattern (missing validation of MiniAdmin class during polymorphic deserialization) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target repository jackson-databind version 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2019-12086. The fix that adds com.mysql.cj.jdbc.admin.MiniAdmin to the polymorphic deserialization blocklist is already present in SubTypeValidator.java line 88. This fix was introduced by upstream maintainer Tatu Saloranta in commit dda513bd72, which predates the first TuxCare commit in HEAD's ancestry (a7a5ae30fc), confirming it was already included in the upstream release that TuxCare onboarded. The vulnerable pattern (missing validation of MiniAdmin class during polymorphic deserialization) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.16.1. The vulnerability involves polymorphic deserialization of the dangerous logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The upstream fix (commit c9ef4a10d6) was authored by Tatu Saloranta and shipped in upstream release 2.16.1 before TuxCare onboarded it. The dangerous class is blocked in SubTypeValidator.java at...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.16.1. The vulnerability involves polymorphic deserialization of the dangerous logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The upstream fix (commit c9ef4a10d6) was authored by Tatu Saloranta and shipped in upstream release 2.16.1 before TuxCare onboarded it. The dangerous class is blocked in SubTypeValidator.java at..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not affecting jackson-databind 2.16.1-tuxcare.3. The vulnerability allows arbitrary file reads via JDOM XSLTransformer deserialization when Default Typing is enabled. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) blocking org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer was already present in the upstream jackson-databind 2.16.1 release that Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is not affecting jackson-databind 2.16.1-tuxcare.3. The vulnerability allows arbitrary file reads via JDOM XSLTransformer deserialization when Default Typing is enabled. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) blocking org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer was already present in the upstream jackson-databind 2.16.1 release that Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6. The target is version 2.16.1-tuxcare.2, which is significantly newer. The vulnerability involves deserialization of the dangerous class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` when default typing is enabled. The fix (adding this class to the blocklist in SubTypeValidator.java) was applied by upstream author Tatu Saloranta on July 25, 2019 (commit ad418eeb97) and is present in the target at line 98. Since version 2.16.1 was released in December 2023 (4+ years after the fix), the fix shipped in the upstream release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6. The target is version 2.16.1-tuxcare.2, which is significantly newer. The vulnerability involves deserialization of the dangerous class `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` when default typing is enabled. The fix (adding this class to the blocklist in SubTypeValidator.java) was applied by upstream author Tatu Saloranta on July 25, 2019 (commit ad418eeb97) and is present in the target at line 98. Since version 2.16.1 was released in December 2023 (4+ years after the fix), the fix shipped in the upstream release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involved missing blacklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that could lead to arbitrary code execution through polymorphic deserialization. Both required blacklist entries are present in SubTypeValidator.java (lines 98, 102). The fix was applied by upstream maintainer Tatu Saloranta in commit ad418eeb974 and was already present in the jackson-databind 2.16.1 release before TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involved missing blacklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that could lead to arbitrary code execution through polymorphic deserialization. Both required blacklist entries are present in SubTypeValidator.java (lines 98, 102). The fix was applied by upstream maintainer Tatu Saloranta in commit ad418eeb974 and was already present in the jackson-databind 2.16.1 release before TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1-tuxcare.3 is not affected by CVE-2019-14540. The fix that blocks deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource was already present in the upstream 2.16.1 release that TuxCare onboarded. The vulnerable polymorphic deserialization pattern is blocked by SubTypeValidator at lines 104-107, preventing malicious instantiation of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "The target jackson-databind 2.16.1-tuxcare.3 is not affected by CVE-2019-14540. The fix that blocks deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource was already present in the upstream 2.16.1 release that TuxCare onboarded. The vulnerable polymorphic deserialization pattern is blocked by SubTypeValidator at lines 104-107, preventing malicious instantiation of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involved polymorphic deserialization of malicious commons-configuration JNDI classes that could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 41b7f9b901 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in upstream release 2.16.1, which TuxCare onboarded. The target version inherits this upstream protection, making the vulnerable code pattern (lack of blocklist entries) absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involved polymorphic deserialization of malicious commons-configuration JNDI classes that could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 41b7f9b901 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist. This fix was already present in upstream release 2.16.1, which TuxCare onboarded. The target version inherits this upstream protection, making the vulnerable code pattern (lack of blocklist entries) absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1 is not affected by CVE-2019-14893. The vulnerability was fixed in upstream commit 998efd7082 (authored by Tatu Saloranta) which added org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.16.1 that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare onboarding commit (5b558ba85a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "The target jackson-databind 2.16.1 is not affected by CVE-2019-14893. The vulnerability was fixed in upstream commit 998efd7082 (authored by Tatu Saloranta) which added org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.16.1 that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare onboarding commit (5b558ba85a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 relates to a polymorphic typing issue allowing HikariDataSource gadget exploitation in jackson-databind. The target repository (version 2.16.1-tuxcare.3) already contains the upstream fix that blocks com.zaxxer.hikari.HikariDataSource from polymorphic deserialization. The fix was shipped in the upstream jackson-databind 2.16.1 release and is present at line 107 of SubTypeValidator.java. The vulnerable code pattern is not present because the upstream vendor's fix was already included when TuxCare onboarded version 2.16.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 relates to a polymorphic typing issue allowing HikariDataSource gadget exploitation in jackson-databind. The target repository (version 2.16.1-tuxcare.3) already contains the upstream fix that blocks com.zaxxer.hikari.HikariDataSource from polymorphic deserialization. The fix was shipped in the upstream jackson-databind 2.16.1 release and is present at line 107 of SubTypeValidator.java. The vulnerable code pattern is not present because the upstream vendor's fix was already included when TuxCare onboarded version 2.16.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 via polymorphic deserialization of commons-dbcp gadget classes (PerUserPoolDataSource, SharedPoolDataSource). The target version 2.16.1-tuxcare.3 contains the upstream fix from commit 328a0f833d (Sept 2019, author: tatu.saloranta@iki.fi) which added these classes to the SubTypeValidator blacklist. This fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10 via polymorphic deserialization of commons-dbcp gadget classes (PerUserPoolDataSource, SharedPoolDataSource). The target version 2.16.1-tuxcare.3 contains the upstream fix from commit 328a0f833d (Sept 2019, author: tatu.saloranta@iki.fi) which added these classes to the SubTypeValidator blacklist. This fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.16.1. The vulnerability (deserialization of p6spy P6DataSource and commons-dbcp DataSource gadget classes leading to RCE) was fixed by upstream in September 2019 via commits 9593e16c and 328a0f83, which added these classes to SubTypeValidator's deserialization blocklist. These fixes were included in the upstream jackson-databind 2.16.1 release (December 2023) before TuxCare onboarded it (March 2026). The blocklist is active by default and blocks all three gadget classes: com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and org.apache.commons.dbcp.datasources.PerUserPoolDataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.16.1. The vulnerability (deserialization of p6spy P6DataSource and commons-dbcp DataSource gadget classes leading to RCE) was fixed by upstream in September 2019 via commits 9593e16c and 328a0f83, which added these classes to SubTypeValidator's deserialization blocklist. These fixes were included in the upstream jackson-databind 2.16.1 release (December 2023) before TuxCare onboarded it (March 2026). The blocklist is active by default and blocks all three gadget classes: com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and org.apache.commons.dbcp.datasources.PerUserPoolDataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.16.1-tuxcare.3. The vulnerability concerns a polymorphic deserialization gadget (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup) that was blocked by upstream in commit 191a4cdf87. This fix was already included in the upstream 2.16.1 release that TuxCare onboarded. The blocklist entry exists at line 99 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.16.1-tuxcare.3. The vulnerability concerns a polymorphic deserialization gadget (net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup) that was blocked by upstream in commit 191a4cdf87. This fix was already included in the upstream 2.16.1 release that TuxCare onboarded. The blocklist entry exists at line 99 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involves deserialization gadget classes from apache-log4j-extras (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable JNDI injection when polymorphic typing is enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.16.1 release that TuxCare onboarded, as confirmed by merge-base analysis showing the fix commit predates the first TuxCare commit (5b558ba85a \"Onboard version 2.16.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involves deserialization gadget classes from apache-log4j-extras (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable JNDI injection when polymorphic typing is enabled. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.16.1 release that TuxCare onboarded, as confirmed by merge-base analysis showing the fix commit predates the first TuxCare commit (5b558ba85a \"Onboard version 2.16.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability required blocking two ehcache classes (GenericJndiSelector and GlassfishSelector) from polymorphic deserialization to prevent JNDI injection attacks. The fix was already included in upstream release 2.16.1 (committed by Tatu Saloranta in fc4214a883) before TuxCare onboarded this version in commit 5b558ba85a. The target's SubTypeValidator.java contains the blocklist entries at lines 133-135, matching the upstream patch exactly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability required blocking two ehcache classes (GenericJndiSelector and GlassfishSelector) from polymorphic deserialization to prevent JNDI injection attacks. The fix was already included in upstream release 2.16.1 (committed by Tatu Saloranta in fc4214a883) before TuxCare onboarded this version in commit 5b558ba85a. The target's SubTypeValidator.java contains the blocklist entries at lines 133-135, matching the upstream patch exactly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target version jackson-databind 2.16.1-tuxcare.3 is not vulnerable to CVE-2020-10650. The upstream vendor (FasterXML) fixed this unsafe deserialization vulnerability in version 2.9.10.4 by adding three ignite-jta and quartz classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. Since version 2.16.1 is much newer than 2.9.10.4, the fix was already present in the upstream release when TuxCare onboarded it. The fix commit a424c038ba (authored by tatu.saloranta@iki.fi) is confirmed to be an ancestor of the first TuxCare commit 5b558ba85a \"Onboard version 2.16.1\". The vulnerable classes org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider are present in the blocklist at lines 157-160 and are actively validated during deserialization via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target version jackson-databind 2.16.1-tuxcare.3 is not vulnerable to CVE-2020-10650. The upstream vendor (FasterXML) fixed this unsafe deserialization vulnerability in version 2.9.10.4 by adding three ignite-jta and quartz classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. Since version 2.16.1 is much newer than 2.9.10.4, the fix was already present in the upstream release when TuxCare onboarded it. The fix commit a424c038ba (authored by tatu.saloranta@iki.fi) is confirmed to be an ancestor of the first TuxCare commit 5b558ba85a \"Onboard version 2.16.1\". The vulnerable classes org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider are present in the blocklist at lines 157-160 and are actively validated during deserialization via BeanDeserializerFactory._validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind version 2.16.1-tuxcare.3 is NOT affected by CVE-2020-10672. The vulnerability involves Jackson's polymorphic type handling allowing deserialization of the dangerous gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.16.1 release that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta on 2020-03-15 (commit 592872f423), years before TuxCare onboarded version 2.16.1 on 2026-03-03. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "Target repository jackson-databind version 2.16.1-tuxcare.3 is NOT affected by CVE-2020-10672. The vulnerability involves Jackson's polymorphic type handling allowing deserialization of the dangerous gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.16.1 release that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta on 2020-03-15 (commit 592872f423), years before TuxCare onboarded version 2.16.1 on 2026-03-03. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1-tuxcare.3 is NOT affected by CVE-2020-10673. The vulnerability concerns deserialization of the malicious gadget class com.caucho.config.types.ResourceRef leading to arbitrary code execution. The upstream vendor (FasterXML) fixed this vulnerability in commit 1645efbd39 (March 17, 2020) by adding ResourceRef to the deserialization blacklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.16.1 when TuxCare onboarded the version in March 2026. The vulnerable code pattern is not present in the target because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target jackson-databind 2.16.1-tuxcare.3 is NOT affected by CVE-2020-10673. The vulnerability concerns deserialization of the malicious gadget class com.caucho.config.types.ResourceRef leading to arbitrary code execution. The upstream vendor (FasterXML) fixed this vulnerability in commit 1645efbd39 (March 17, 2020) by adding ResourceRef to the deserialization blacklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.16.1 when TuxCare onboarded the version in March 2026. The vulnerable code pattern is not present in the target because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.1-tuxcare.3) is NOT AFFECTED by CVE-2020-10968. The vulnerability pattern has been removed by an upstream fix that was already present in the 2.16.1 release before TuxCare onboarded it. The SubTypeValidator.java file contains the defense mechanism that blocks the gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider from deserialization, preventing the exploitation of this serialization gadget vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target repository (jackson-databind 2.16.1-tuxcare.3) is NOT AFFECTED by CVE-2020-10968. The vulnerability pattern has been removed by an upstream fix that was already present in the 2.16.1 release before TuxCare onboarded it. The SubTypeValidator.java file contains the defense mechanism that blocks the gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider from deserialization, preventing the exploitation of this serialization gadget vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1-tuxcare.3 is NOT affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane through Jackson's polymorphic type handling, enabling arbitrary code execution. The fix (adding JEditorPane to the deserialization blocklist in SubTypeValidator) was already present in the upstream Jackson 2.16.1 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit 4d038c9de0a on 2020-03-03, predating the 2.16.1 release by years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target jackson-databind 2.16.1-tuxcare.3 is NOT affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane through Jackson's polymorphic type handling, enabling arbitrary code execution. The fix (adding JEditorPane to the deserialization blocklist in SubTypeValidator) was already present in the upstream Jackson 2.16.1 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit 4d038c9de0a on 2020-03-03, predating the 2.16.1 release by years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target version 2.16.1 already contains the fix in its upstream release. The vulnerability involves unsafe deserialization of org.apache.activemq.* classes as polymorphic type gadgets. The fix adds these classes to the SubTypeValidator blacklist (DEFAULT_NO_DESER_CLASS_NAMES). Analysis confirms the activemq blacklist entries are present at SubTypeValidator.java:173-183, added by upstream commit c14c9f99ed0 (author: tatu.saloranta@iki.fi) which was IN_UPSTREAM_RELEASE before the first TuxCare commit (a7a5ae30fc). The vulnerable code pattern is not present because the upstream 2.16.1 release shipped with the fix already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target version 2.16.1 already contains the fix in its upstream release. The vulnerability involves unsafe deserialization of org.apache.activemq.* classes as polymorphic type gadgets. The fix adds these classes to the SubTypeValidator blacklist (DEFAULT_NO_DESER_CLASS_NAMES). Analysis confirms the activemq blacklist entries are present at SubTypeValidator.java:173-183, added by upstream commit c14c9f99ed0 (author: tatu.saloranta@iki.fi) which was IN_UPSTREAM_RELEASE before the first TuxCare commit (a7a5ae30fc). The vulnerable code pattern is not present because the upstream 2.16.1 release shipped with the fix already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.16.1-tuxcare.3. The vulnerability concerns deserialization gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The target already contains the upstream fix (blocklist entry at SubTypeValidator.java:186) which was shipped in the upstream release 2.16.1 before TuxCare onboarding. Fix commit 05d7e0e13f by Tatu Saloranta (upstream maintainer) is an ancestor of TuxCare's onboarding commit 5b558ba85a, confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.16.1-tuxcare.3. The vulnerability concerns deserialization gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The target already contains the upstream fix (blocklist entry at SubTypeValidator.java:186) which was shipped in the upstream release 2.16.1 before TuxCare onboarding. Fix commit 05d7e0e13f by Tatu Saloranta (upstream maintainer) is an ancestor of TuxCare's onboarding commit 5b558ba85a, confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.1 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the malicious gadget class \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" which could lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist) was already present in upstream version 2.16.1 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit e2ba12d5 (March 2020) and shipped in the upstream release, predating the TuxCare onboarding commit 5b558ba85a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "Target version 2.16.1 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the malicious gadget class \"org.apache.openjpa.ee.WASRegistryManagedRuntime\" which could lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist) was already present in upstream version 2.16.1 when TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta in commit e2ba12d5 (March 2020) and shipped in the upstream release, predating the TuxCare onboarding commit 5b558ba85a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in jackson-databind 2.16.1-tuxcare.3. The upstream fix (commit 113e89fb08) that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already included in the upstream 2.16.1 release. The target version inherits this fix from upstream, with both gadget classes present in SubTypeValidator's blocklist at lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is not present in jackson-databind 2.16.1-tuxcare.3. The upstream fix (commit 113e89fb08) that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean was already included in the upstream 2.16.1 release. The target version inherits this fix from upstream, with both gadget classes present in SubTypeValidator's blocklist at lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target version 2.16.1 is not affected by CVE-2020-11620. The vulnerability involves Jackson-databind deserializing org.apache.commons.jelly.impl.Embedded, a known deserialization gadget class that enables arbitrary code execution. The upstream vendor (FasterXML) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in commit 77040d85e3eb6710508e6445640ae1a3d5e60c22, which was included in upstream release 2.16.1. TuxCare onboarded version 2.16.1 in commit 5b558ba85a26f04304676c828ab9b73e9c32b2be, which already contained this upstream fix. The blocklist is enforced by SubTypeValidator.validateSubType() during bean deserialization, preventing the vulnerable class from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target version 2.16.1 is not affected by CVE-2020-11620. The vulnerability involves Jackson-databind deserializing org.apache.commons.jelly.impl.Embedded, a known deserialization gadget class that enables arbitrary code execution. The upstream vendor (FasterXML) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in commit 77040d85e3eb6710508e6445640ae1a3d5e60c22, which was included in upstream release 2.16.1. TuxCare onboarded version 2.16.1 in commit 5b558ba85a26f04304676c828ab9b73e9c32b2be, which already contained this upstream fix. The blocklist is enforced by SubTypeValidator.validateSubType() during bean deserialization, preventing the vulnerable class from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.16.1-tuxcare.3 already contains the upstream fix that adds the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` to the deserialization blacklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.16.1 release before TuxCare onboarding. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5. The target version 2.16.1-tuxcare.3 already contains the upstream fix that adds the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` to the deserialization blacklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream 2.16.1 release before TuxCare onboarding. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involves deserialization of oracle.jms gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) that enable arbitrary code execution. The upstream vendor (Tatu Saloranta) fixed this in commit 5c8642aeae by adding these five classes to the deserialization blacklist in SubTypeValidator.java. This fix shipped in upstream version 2.9.10.5 (released in 2020), and the target version 2.16.1 (released later) inherited the fix from upstream. The blacklist enforcement is mandatory, comprehensive, and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involves deserialization of oracle.jms gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) that enable arbitrary code execution. The upstream vendor (Tatu Saloranta) fixed this in commit 5c8642aeae by adding these five classes to the deserialization blacklist in SubTypeValidator.java. This fix shipped in upstream version 2.9.10.5 (released in 2020), and the target version 2.16.1 (released later) inherited the fix from upstream. The blacklist enforcement is mandatory, comprehensive, and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 related to the deserialization gadget com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target version 2.16.1 already contains the upstream fix that adds this class to the SubTypeValidator denylist (line 119). The fix was introduced by upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta and was already present when TuxCare onboarded version 2.16.1 (commit 5b558ba85a). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 related to the deserialization gadget com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target version 2.16.1 already contains the upstream fix that adds this class to the SubTypeValidator denylist (line 119). The fix was introduced by upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta and was already present when TuxCare onboarded version 2.16.1 (commit 5b558ba85a). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a missing blacklist entry for the org.jsecurity.realm.jndi.JndiRealmFactory deserialization gadget. The target version 2.16.1-tuxcare.3 already contains the upstream fix (commit f6d9c664f6d by Tatu Saloranta) that adds this gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist at line 207 of SubTypeValidator.java. This fix was included in the upstream 2.16.1 release that TuxCare onboarded, not added as a TuxCare backport. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a missing blacklist entry for the org.jsecurity.realm.jndi.JndiRealmFactory deserialization gadget. The target version 2.16.1-tuxcare.3 already contains the upstream fix (commit f6d9c664f6d by Tatu Saloranta) that adds this gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist at line 207 of SubTypeValidator.java. This fix was included in the upstream 2.16.1 release that TuxCare onboarded, not added as a TuxCare backport. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1-tuxcare.3 is not affected by CVE-2020-24616. The fix (blocklist entry for br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator) was already present in the upstream jackson-databind 2.16.1 release that TuxCare onboarded. The vulnerable deserialization gadget cannot be exploited because the class is blocked by default during polymorphic type validation. Fix commit: 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), predating TuxCare's onboarding commit 5b558ba85a26f04304676c828ab9b73e9c32b2be.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "The target jackson-databind 2.16.1-tuxcare.3 is not affected by CVE-2020-24616. The fix (blocklist entry for br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator) was already present in the upstream jackson-databind 2.16.1 release that TuxCare onboarded. The vulnerable deserialization gadget cannot be exploited because the class is blocked by default during polymorphic type validation. Fix commit: 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), predating TuxCare's onboarding commit 5b558ba85a26f04304676c828ab9b73e9c32b2be.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x-2.9.x before 2.9.10.6. The vulnerability allows arbitrary code execution via JNDI injection when deserializing the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class. The target version 2.16.1 is significantly newer than the affected range and contains the upstream fix (commit 6cc9f1a1af) that adds JndiConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x-2.9.x before 2.9.10.6. The vulnerability allows arbitrary code execution via JNDI injection when deserializing the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class. The target version 2.16.1 is significantly newer than the affected range and contains the upstream fix (commit 6cc9f1a1af) that adds JndiConfiguration to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.16.1-tuxcare.3. The upstream fix (commits 612f971b78 and 3d932709ab) was already included in the upstream release 2.16.1 that TuxCare onboarded. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XML external entity attacks. The vulnerable pattern (missing XXE protection) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.16.1-tuxcare.3. The upstream fix (commits 612f971b78 and 3d932709ab) was already included in the upstream release 2.16.1 that TuxCare onboarded. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XML external entity attacks. The vulnerable pattern (missing XXE protection) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2020-35490. The vulnerability pattern has been removed by upstream commit 41b8bdb5cc (Fixed #2986) authored by Tatu Saloranta, which added org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization denylist. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded, predating all TuxCare commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target repository jackson-databind version 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2020-35490. The vulnerability pattern has been removed by upstream commit 41b8bdb5cc (Fixed #2986) authored by Tatu Saloranta, which added org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization denylist. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded, predating all TuxCare commits on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.1-tuxcare.2 is NOT affected by CVE-2020-35491. The vulnerability affects versions before 2.9.10.8, and the fix was included in the upstream 2.9.10.8 release (December 2020) and all subsequent versions. The target version 2.16.1 already contains the upstream fix that adds blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to prevent deserialization gadget attacks. The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "The target jackson-databind version 2.16.1-tuxcare.2 is NOT affected by CVE-2020-35491. The vulnerability affects versions before 2.9.10.8, and the fix was included in the upstream 2.9.10.8 release (December 2020) and all subsequent versions. The target version 2.16.1 already contains the upstream fix that adds blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to prevent deserialization gadget attacks. The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.16.1-tuxcare.3. The dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java line 240. This fix was introduced in upstream commit 1ca0388c2f by Tatu Saloranta on Dec 26, 2020, and shipped with upstream release 2.12.1 and all subsequent releases including 2.16.1. The vulnerable pattern is not present in the target because the upstream vendor fix was already included in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.16.1-tuxcare.3. The dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java line 240. This fix was introduced in upstream commit 1ca0388c2f by Tatu Saloranta on Dec 26, 2020, and shipped with upstream release 2.12.1 and all subsequent releases including 2.16.1. The vulnerable pattern is not present in the target because the upstream vendor fix was already included in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.1-tuxcare.3 is not affected by CVE-2020-36179. The vulnerability concerns deserialization gadgets related to DriverAdapterCPDS classes. The upstream fix (commit 3ded28aece, authored by Tatu Saloranta) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was included in the upstream 2.16.1 release that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport. The target's SubTypeValidator contains all five DriverAdapterCPDS variants in the blocklist and actively rejects their deserialization with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "Target jackson-databind 2.16.1-tuxcare.3 is not affected by CVE-2020-36179. The vulnerability concerns deserialization gadgets related to DriverAdapterCPDS classes. The upstream fix (commit 3ded28aece, authored by Tatu Saloranta) added these classes to SubTypeValidator's blocklist, preventing their deserialization. This fix was included in the upstream 2.16.1 release that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport. The target's SubTypeValidator contains all five DriverAdapterCPDS variants in the blocklist and actively rejects their deserialization with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1 is NOT affected by CVE-2020-36180. The vulnerability relates to unsafe deserialization of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS gadget classes. The upstream fix (commit 3ded28aece) that adds these classes to SubTypeValidator's deserialization blocklist was already present in the upstream release 2.16.1 that TuxCare onboarded. All five DriverAdapterCPDS variant class names are confirmed present in the blocklist at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target jackson-databind 2.16.1 is NOT affected by CVE-2020-36180. The vulnerability relates to unsafe deserialization of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS gadget classes. The upstream fix (commit 3ded28aece) that adds these classes to SubTypeValidator's deserialization blocklist was already present in the upstream release 2.16.1 that TuxCare onboarded. All five DriverAdapterCPDS variant class names are confirmed present in the blocklist at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36181. The vulnerability involves deserialization gadgets using org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related DBCP adapter classes. The upstream fix (commit 3ded28aece, dated 2020-12-31) added all five DriverAdapterCPDS variants to the SubTypeValidator blocklist. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded, authored by Tatu Saloranta (tatu.saloranta@iki.fi). The vulnerable code pattern (missing blocklist entries) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target jackson-databind 2.16.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36181. The vulnerability involves deserialization gadgets using org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related DBCP adapter classes. The upstream fix (commit 3ded28aece, dated 2020-12-31) added all five DriverAdapterCPDS variants to the SubTypeValidator blocklist. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded, authored by Tatu Saloranta (tatu.saloranta@iki.fi). The vulnerable code pattern (missing blocklist entries) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions before 2.9.10.8, but the target is version 2.16.1 which already contains the upstream fix. The vulnerable class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS is blocked in SubTypeValidator.java (line 234) through upstream commit 3ded28aece made on 2020-12-31. This fix was included in the upstream 2.16.1 release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 affects jackson-databind versions before 2.9.10.8, but the target is version 2.16.1 which already contains the upstream fix. The vulnerable class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS is blocked in SubTypeValidator.java (line 234) through upstream commit 3ded28aece made on 2020-12-31. This fix was included in the upstream 2.16.1 release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 affects jackson-databind versions before 2.9.10.8 and involves the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class. The target version 2.16.1-tuxcare.3 already contains the upstream fix (commit 12e23c962f by Tatu Saloranta) which was included in jackson-databind 2.12.1 and all subsequent versions. The fix adds the vulnerable class to the deserialization blocklist in SubTypeValidator.java at line 243. Since this fix was present in the upstream 2.16.1 release that TuxCare onboarded, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 affects jackson-databind versions before 2.9.10.8 and involves the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class. The target version 2.16.1-tuxcare.3 already contains the upstream fix (commit 12e23c962f by Tatu Saloranta) which was included in jackson-databind 2.12.1 and all subsequent versions. The fix adds the vulnerable class to the deserialization blocklist in SubTypeValidator.java at line 243. Since this fix was present in the upstream 2.16.1 release that TuxCare onboarded, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind 2.x before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target version 2.16.1-tuxcare.2 is not affected because the upstream fix (commit 567194c53a \"Fixed #2998\") was already present in the upstream 2.16.1 release. The fix adds both vulnerable class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 235-236), which is checked during deserialization via BeanDeserializerFactory. The fix was authored by upstream maintainer Tatu Saloranta and predates TuxCare's onboarding of version 2.16.1, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind 2.x before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target version 2.16.1-tuxcare.2 is not affected because the upstream fix (commit 567194c53a \"Fixed #2998\") was already present in the upstream 2.16.1 release. The fix adds both vulnerable class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 235-236), which is checked during deserialization via BeanDeserializerFactory. The fix was authored by upstream maintainer Tatu Saloranta and predates TuxCare's onboarding of version 2.16.1, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.1-tuxcare.3 is NOT affected by CVE-2020-36185. The vulnerability involves deserialization gadgets using org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.16.1 before TuxCare onboarded it (first TuxCare commit 5b558ba85a \"Onboard version 2.16.1\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "Target jackson-databind 2.16.1-tuxcare.3 is NOT affected by CVE-2020-36185. The vulnerability involves deserialization gadgets using org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.16.1 before TuxCare onboarded it (first TuxCare commit 5b558ba85a \"Onboard version 2.16.1\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is not present in jackson-databind 2.16.1. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The upstream fix (commit 3e8fa3beea4 by Tatu Saloranta, 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix shipped with upstream version 2.9.10.8 and is present in all subsequent versions including 2.16.1. The target contains the fix at SubTypeValidator.java lines 229-230, and the fix was part of the upstream release before TuxCare onboarding (commit 5b558ba85a26f04).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is not present in jackson-databind 2.16.1. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource classes. The upstream fix (commit 3e8fa3beea4 by Tatu Saloranta, 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix shipped with upstream version 2.9.10.8 and is present in all subsequent versions including 2.16.1. The target contains the fix at SubTypeValidator.java lines 229-230, and the fix was part of the upstream release before TuxCare onboarding (commit 5b558ba85a26f04).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.16.1. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 3e8fa3beea (Dec 26, 2020) by adding these classes to the SubTypeValidator blocklist. This fix was already included in the upstream 2.16.1 release when TuxCare onboarded it (commit 5b558ba85a by askorik@cloudlinux.com). The blocklist entries are present at SubTypeValidator.java:228-230, and the validation is active in the deserialization path via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.16.1. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 3e8fa3beea (Dec 26, 2020) by adding these classes to the SubTypeValidator blocklist. This fix was already included in the upstream 2.16.1 release when TuxCare onboarded it (commit 5b558ba85a by askorik@cloudlinux.com). The blocklist entries are present at SubTypeValidator.java:228-230, and the validation is active in the deserialization path via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.16.1-tuxcare.3. The fix blocking deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes was already included in the upstream Jackson 2.16.1 release. The blacklist entries are present in SubTypeValidator.java (lines 223-224) and actively enforced in the deserialization path via BeanDeserializerFactory.createBeanDeserializer(). The fix was authored by upstream maintainer Tatu Saloranta in commit 33d96c13fe1 on 2020-12-26, which was already present when TuxCare onboarded version 2.16.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.16.1-tuxcare.3. The fix blocking deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes was already included in the upstream Jackson 2.16.1 release. The blacklist entries are present in SubTypeValidator.java (lines 223-224) and actively enforced in the deserialization path via BeanDeserializerFactory.createBeanDeserializer(). The fix was authored by upstream maintainer Tatu Saloranta in commit 33d96c13fe1 on 2020-12-26, which was already present when TuxCare onboarded version 2.16.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.16.1. The vulnerability was fixed in upstream version 2.9.10.8 (released Dec 2020) by adding two newrelic-agent gadget classes to the SubTypeValidator blocklist. The target version 2.16.1 (released Dec 2023) already contains this upstream fix, which was included when TuxCare onboarded the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.16.1. The vulnerability was fixed in upstream version 2.9.10.8 (released Dec 2020) by adding two newrelic-agent gadget classes to the SubTypeValidator blocklist. The target version 2.16.1 (released Dec 2023) already contains this upstream fix, which was included when TuxCare onboarded the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability (stack overflow from deeply nested JSON) was fixed in upstream version 2.16.x through a complete architectural change: the vulnerable recursive deserializer (Vanilla class) was replaced with a non-recursive iterative implementation (UntypedObjectDeserializerNR) that eliminates stack overflow risk. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded. Additionally, jackson-core provides ambient depth limiting via StreamReadConstraints.DEFAULT_MAX_DEPTH that protects all deserialization paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability (stack overflow from deeply nested JSON) was fixed in upstream version 2.16.x through a complete architectural change: the vulnerable recursive deserializer (Vanilla class) was replaced with a non-recursive iterative implementation (UntypedObjectDeserializerNR) that eliminates stack overflow risk. This fix was already present in the upstream 2.16.1 release that TuxCare onboarded. Additionally, jackson-core provides ambient depth limiting via StreamReadConstraints.DEFAULT_MAX_DEPTH that protects all deserialization paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability affects versions lacking blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks during polymorphic JSON deserialization. The fix was already present in upstream release 2.16.1 (commit 914e7c9f2c by Tatu Saloranta) before TuxCare onboarded this version. The target contains the complete defense: SubTypeValidator.java line 138 adds JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, and the validateSubType() method (lines 259-304) blocks deserialization of any class in this set, throwing a security exception before the malicious class can be instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability affects versions lacking blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, which enables JNDI injection attacks during polymorphic JSON deserialization. The fix was already present in upstream release 2.16.1 (commit 914e7c9f2c by Tatu Saloranta) before TuxCare onboarded this version. The target contains the complete defense: SubTypeValidator.java line 138 adds JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, and the validateSubType() method (lines 259-304) blocks deserialization of any class in this set, throwing a security exception before the malicious class can be instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.1 is not affected by CVE-2020-9546. The fix that adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization blocklist was already present in the upstream 2.16.1 release (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 by upstream maintainer Tatu Saloranta), which TuxCare subsequently onboarded. The vulnerable code pattern (missing blocklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "Target version 2.16.1 is not affected by CVE-2020-9546. The fix that adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the deserialization blocklist was already present in the upstream 2.16.1 release (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 by upstream maintainer Tatu Saloranta), which TuxCare subsequently onboarded. The vulnerable code pattern (missing blocklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 concerns Jackson deserialization gadgets related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target jackson-databind version 2.16.1-tuxcare.3 already contains the upstream fix that blocklists this gadget class. The fix (commit 9f4e97019fb by upstream maintainer Tatu Saloranta, dated 2020-02-29) was present in the upstream release that TuxCare onboarded (commit 5b558ba85a, 2024-01-17). The vulnerable pattern is not present because SubTypeValidator.java:144 adds JtaTransactionConfig to DEFAULT_NO_DESER_CLASS_NAMES, preventing its deserialization. The validation is enforced in BeanDeserializerFactory.createBeanDeserializer() at line 141 before any deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 concerns Jackson deserialization gadgets related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target jackson-databind version 2.16.1-tuxcare.3 already contains the upstream fix that blocklists this gadget class. The fix (commit 9f4e97019fb by upstream maintainer Tatu Saloranta, dated 2020-02-29) was present in the upstream release that TuxCare onboarded (commit 5b558ba85a, 2024-01-17). The vulnerable pattern is not present because SubTypeValidator.java:144 adds JtaTransactionConfig to DEFAULT_NO_DESER_CLASS_NAMES, preventing its deserialization. The validation is enforced in BeanDeserializerFactory.createBeanDeserializer() at line 141 before any deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The upstream FasterXML fix (commit 9f4e97019fb0) that adds this class to the deserialization blocklist was already included in the upstream 2.16.1 release that TuxCare onboarded. The target version has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.16.1-tuxcare.3. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The upstream FasterXML fix (commit 9f4e97019fb0) that adds this class to the deserialization blocklist was already included in the upstream 2.16.1 release that TuxCare onboarded. The target version has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7, involving deserialization gadgets that allow remote code execution through polymorphic type handling. The target version 2.16.1 already contains the upstream fixes (commits 7dbf51bf78 and 08fbfacf89) that add javax.swing.JTextPane and numerous other dangerous classes to the SubTypeValidator blocklist. These fixes were part of the upstream jackson-databind 2.16.1 release that TuxCare onboarded, not TuxCare backports. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7, involving deserialization gadgets that allow remote code execution through polymorphic type handling. The target version 2.16.1 already contains the upstream fixes (commits 7dbf51bf78 and 08fbfacf89) that add javax.swing.JTextPane and numerous other dangerous classes to the SubTypeValidator blocklist. These fixes were part of the upstream jackson-databind 2.16.1 release that TuxCare onboarded, not TuxCare backports. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is NOT present in jackson-databind 2.16.1. The vulnerability involved unbounded memory allocation in NodeSerialization.readExternal() when deserializing JDK-serialized JsonNode objects. The upstream fix (commit 3ccde7d938) was already included in the 2.16.1 release that TuxCare onboarded. The fix limits eager allocation to 100KB and uses incremental reading via ByteArrayBuilder for larger declared sizes, preventing DoS attacks via malicious length values.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 is NOT present in jackson-databind 2.16.1. The vulnerability involved unbounded memory allocation in NodeSerialization.readExternal() when deserializing JDK-serialized JsonNode objects. The upstream fix (commit 3ccde7d938) was already included in the 2.16.1 release that TuxCare onboarded. The fix limits eager allocation to 100KB and uses incremental reading via ByteArrayBuilder for larger declared sizes, preventing DoS attacks via malicious length values.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.1-tuxcare.3 is not affected by CVE-2022-42003 because the fix was already present in the upstream 2.16.1 release when TuxCare onboarded it. CVE-2022-42003 affects versions 2.4.0-rc1 until 2.12.7.1 and 2.13.x before 2.13.4.2, fixed in upstream 2.12.7.1, 2.13.4.2, and 2.14.0. Since 2.16.1 is after 2.14.0, it includes the upstream fix that prevents resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "Target version 2.16.1-tuxcare.3 is not affected by CVE-2022-42003 because the fix was already present in the upstream 2.16.1 release when TuxCare onboarded it. CVE-2022-42003 affects versions 2.4.0-rc1 until 2.12.7.1 and 2.13.x before 2.13.4.2, fixed in upstream 2.12.7.1, 2.13.4.2, and 2.14.0. Since 2.16.1 is after 2.14.0, it includes the upstream fix that prevents resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 targets a resource exhaustion vulnerability in jackson-databind's BeanDeserializer._deserializeFromArray() method when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The vulnerability allows deeply nested JSON arrays to cause unbounded recursion. The target repository (jackson-databind 2.16.1-tuxcare.3) contains the upstream fix that was introduced in jackson-databind 2.13.4. The fix adds a check at lines 638-646 of BeanDeserializer.java that rejects deeply nested arrays by detecting a second START_ARRAY token after the first wrapper. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.16.1 release that TuxCare onboarded. Therefore, the target is not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 targets a resource exhaustion vulnerability in jackson-databind's BeanDeserializer._deserializeFromArray() method when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The vulnerability allows deeply nested JSON arrays to cause unbounded recursion. The target repository (jackson-databind 2.16.1-tuxcare.3) contains the upstream fix that was introduced in jackson-databind 2.13.4. The fix adds a check at lines 638-646 of BeanDeserializer.java that rejects deeply nested arrays by detecting a second START_ARRAY token after the first wrapper. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.16.1 release that TuxCare onboarded. Therefore, the target is not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 affects jackson-databind versions prior to 2.14.0, where deeply nested JSON structures cause StackOverflowError when serialized via JsonNode.toString(). The target version 2.16.1-tuxcare.3 ships with the upstream fix (commit a1fa4ae4ec from May 2022) that replaced recursive serialization with iterative serialization using an explicit IteratorStack. This fix was already present in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 affects jackson-databind versions prior to 2.14.0, where deeply nested JSON structures cause StackOverflowError when serialized via JsonNode.toString(). The target version 2.16.1-tuxcare.3 ships with the upstream fix (commit a1fa4ae4ec from May 2022) that replaced recursive serialization with iterative serialization using an explicit IteratorStack. This fix was already present in..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.16.1 is not affected by CVE-2026-54518. The vulnerability requires the combination of @JsonUnwrapped with creator parameters, a feature that does not exist in version 2.16.1. The target explicitly rejects this combination with error \"Cannot define Creator parameter as @JsonUnwrapped: combination not yet supported\". The vulnerable method processUnwrappedCreatorProperties() does not exi...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.16.1 is not affected by CVE-2026-54518. The vulnerability requires the combination of @JsonUnwrapped with creator parameters, a feature that does not exist in version 2.16.1. The target explicitly rejects this combination with error \"Cannot define Creator parameter as @JsonUnwrapped: combination not yet supported\". The vulnerable method processUnwrappedCreatorProperties() does not exi..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      },
      "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.16.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:14:22.471817+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.16.1-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}