{
  "@id": "urn:uuid:a6c45e1a-e2aa-4e31-8203-4118e88be40d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 64,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:21:00.146665+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.17.2-tuxcare.2. The vulnerability was fixed in upstream versions 2.8.11 and 2.9.4 (released 2017) by adding dangerous classes to a deserialization blacklist. The target version 2.17.2 (released 2024) already contains the upstream fix that shipped years before TuxCare's onboarding. All CVE-2017-15095 blacklist entries are present in SubTypeValidator.java at lines 47-51, with additional sophisticated checks for Spring (lines 278-287) and C3P0 classes (lines 288-297). The fix commit (ddfddfba6414adbecaff99684ef66eebd3a92e92) by Tatu Saloranta was IN_UPSTREAM_RELEASE before the first TuxCare commit (25f42ada38412c02d3c5271e6dd1e02f4ed52461).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.17.2-tuxcare.2. The vulnerability was fixed in upstream versions 2.8.11 and 2.9.4 (released 2017) by adding dangerous classes to a deserialization blacklist. The target version 2.17.2 (released 2024) already contains the upstream fix that shipped years before TuxCare's onboarding. All CVE-2017-15095 blacklist entries are present in SubTypeValidator.java at lines 47-51, with additional sophisticated checks for Spring (lines 278-287) and C3P0 classes (lines 288-297). The fix commit (ddfddfba6414adbecaff99684ef66eebd3a92e92) by Tatu Saloranta was IN_UPSTREAM_RELEASE before the first TuxCare commit (25f42ada38412c02d3c5271e6dd1e02f4ed52461).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 fixes were already present in the upstream jackson-databind 2.17.2 release. The target repository (version 2.17.2-tuxcare.3) contains all required blacklist entries and pattern-based defenses in SubTypeValidator.java. The vulnerability pattern is not present because upstream commits e865a7a446 (databind#1737) and 2235894210 (databind#1855) \u2014 both authored by non-TuxCare developers \u2014 were shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 fixes were already present in the upstream jackson-databind 2.17.2 release. The target repository (version 2.17.2-tuxcare.3) contains all required blacklist entries and pattern-based defenses in SubTypeValidator.java. The vulnerability pattern is not present because upstream commits e865a7a446 (databind#1737) and 2235894210 (databind#1855) \u2014 both authored by non-TuxCare developers \u2014 were shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:29:00.089538+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.17.2-tuxcare.3. The upstream vendor (FasterXML) fixed this deserialization vulnerability in 2017 by adding a blacklist of dangerous classes (including TemplatesImpl) to SubTypeValidator. The fix was already present in upstream Jackson 2.17.2 before TuxCare onboarded this version. The target contains the complete defense: SubTypeValidator blocks deserialization of com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl, preventing arbitrary code execution via malicious JSON payloads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.17.2-tuxcare.3. The upstream vendor (FasterXML) fixed this deserialization vulnerability in 2017 by adding a blacklist of dangerous classes (including TemplatesImpl) to SubTypeValidator. The fix was already present in upstream Jackson 2.17.2 before TuxCare onboarded this version. The target contains the complete defense: SubTypeValidator blocks deserialization of com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl and org.apache.xalan.xsltc.trax.TemplatesImpl, preventing arbitrary code execution via malicious JSON payloads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.17.2. The vulnerability involved polymorphic deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser, which could enable data exfiltration via XXE attacks when Jackson default typing is enabled. The fix (blacklisting XPathParser in SubTypeValidator) was applied upstream in May 2018 (commit 27b4defc27, fixing issue #2032) and shipped in versions 2.7.9.4, 2.8.11.2, and 2.9.6. Version 2.17.2 was released years later and includes this fix in the upstream release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:65.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.17.2. The vulnerability involved polymorphic deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser, which could enable data exfiltration via XXE attacks when Jackson default typing is enabled. The fix (blacklisting XPathParser in SubTypeValidator) was applied upstream in May 2018 (commit 27b4defc27, fixing issue #2032) and shipped in versions 2.7.9.4, 2.8.11.2, and 2.9.6. Version 2.17.2 was released years later and includes this fix in the upstream release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:65.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:10.514084+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.17.2-tuxcare.3 is not affected because the upstream fix (blacklisting three JNDI/LDAP gadget classes in SubTypeValidator.java) was already present in upstream release 2.17.2, which TuxCare subsequently onboarded. The fix prevents polymorphic deserialization of jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet, blocking the JNDI/LDAP injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.17.2-tuxcare.3 is not affected because the upstream fix (blacklisting three JNDI/LDAP gadget classes in SubTypeValidator.java) was already present in upstream release 2.17.2, which TuxCare subsequently onboarded. The fix prevents polymorphic deserialization of jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet, blocking the JNDI/LDAP injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:21:06.039557+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.17.2-tuxcare.3 already contains the upstream fix that adds Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blacklist. This fix was shipped in upstream release 2.7.9.4 (June 2018) and is present in all subsequent versions including 2.17.2. The fix commit 28badf7ef6 by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's initial 2.17.2 onboarding commit, confirming the vulnerability was already patched in the upstream release before TuxCare adoption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.17.2-tuxcare.3 already contains the upstream fix that adds Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to the SubTypeValidator blacklist. This fix was shipped in upstream release 2.7.9.4 (June 2018) and is present in all subsequent versions including 2.17.2. The fix commit 28badf7ef6 by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's initial 2.17.2 onboarding commit, confirming the vulnerability was already patched in the upstream release before TuxCare adoption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:54.438603+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 addresses polymorphic deserialization of slf4j-ext classes that could lead to arbitrary code execution. The target jackson-databind version 2.17.2-tuxcare.3 is NOT affected because the upstream fix (commit 87d29af25e) was already present in the upstream release 2.17.2 when TuxCare onboarded it. The blacklist in SubTypeValidator.java includes \"org.slf4j.ext.EventData\" and the other classes from the patch, and the validation is actively enforced in the deserialization process, throwing an exception for illegal types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 addresses polymorphic deserialization of slf4j-ext classes that could lead to arbitrary code execution. The target jackson-databind version 2.17.2-tuxcare.3 is NOT affected because the upstream fix (commit 87d29af25e) was already present in the upstream release 2.17.2 when TuxCare onboarded it. The blacklist in SubTypeValidator.java includes \"org.slf4j.ext.EventData\" and the other classes from the patch, and the validation is actively enforced in the deserialization process, throwing an exception for illegal types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involved failure to block BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) from polymorphic deserialization, allowing arbitrary code execution. The fix adding these classes to the deserialization blocklist was already included in the upstream jackson-databind 2.17.2 release that TuxCare onboarded. The target version (2.17.2) is well beyond the CVE's affected version range (before 2.9.7, 2.8.11.3, and 2.7.9.5). The blocklist is enforced at runtime through SubTypeValidator.validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involved failure to block BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) from polymorphic deserialization, allowing arbitrary code execution. The fix adding these classes to the deserialization blocklist was already included in the upstream jackson-databind 2.17.2 release that TuxCare onboarded. The target version (2.17.2) is well beyond the CVE's affected version range (before 2.9.7, 2.8.11.3, and 2.7.9.5). The blocklist is enforced at runtime through SubTypeValidator.validateSubType() called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:08:25.826245+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT affected by CVE-2018-14720. The vulnerability pattern is absent because the upstream vendor (FasterXML) already included the fix in release 2.17.2, which TuxCare subsequently onboarded. The fix adds four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to the deserialization blacklist in SubTypeValidator.java, preventing XXE attacks and other dangerous operations through polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT affected by CVE-2018-14720. The vulnerability pattern is absent because the upstream vendor (FasterXML) already included the fix in release 2.17.2, which TuxCare subsequently onboarded. The fix adds four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to the deserialization blacklist in SubTypeValidator.java, preventing XXE attacks and other dangerous operations through polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:38:50.686696+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2018-14721. The vulnerability was fixed in the upstream release before TuxCare onboarded version 2.17.2. The blacklist entry for 'org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl' is present in SubTypeValidator.java (line 78) and actively enforced during polymorphic deserialization (line 269), blocking SSRF attacks via this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2018-14721. The vulnerability was fixed in the upstream release before TuxCare onboarded version 2.17.2. The blacklist entry for 'org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl' is present in SubTypeValidator.java (line 78) and actively enforced during polymorphic deserialization (line 269), blocking SSRF attacks via this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:11.363618+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.17.2-tuxcare.2 is NOT affected by CVE-2018-19360. The vulnerability concerns polymorphic deserialization of the \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" class, which the CVE states affects \"2.x before 2.9.8\". The fix was introduced in upstream commit 72cd4025a2 (dated 2018-11-19) and was already present in the upstream 2.17.2 release when TuxCare onboarded it in August 2026. The SubTypeValidator.java file contains the blocklist entry at line 85, preventing deserialization of this dangerous class. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "The target jackson-databind version 2.17.2-tuxcare.2 is NOT affected by CVE-2018-19360. The vulnerability concerns polymorphic deserialization of the \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" class, which the CVE states affects \"2.x before 2.9.8\". The fix was introduced in upstream commit 72cd4025a2 (dated 2018-11-19) and was already present in the upstream 2.17.2 release when TuxCare onboarded it in August 2026. The SubTypeValidator.java file contains the blocklist entry at line 85, preventing deserialization of this dangerous class. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:56:42.390113+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 concerns jackson-databind's failure to block openjpa classes from polymorphic deserialization. The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT affected because the upstream fix was already present in the release version that TuxCare onboarded. The vulnerable pattern (missing openjpa blocklist entries) does not exist in the target code. The fix commit 72cd4025a2 by upstream author Tatu Saloranta added org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, and this fix shipped in the upstream release before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 concerns jackson-databind's failure to block openjpa classes from polymorphic deserialization. The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT affected because the upstream fix was already present in the release version that TuxCare onboarded. The vulnerable pattern (missing openjpa blocklist entries) does not exist in the target code. The fix commit 72cd4025a2 by upstream author Tatu Saloranta added org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, and this fix shipped in the upstream release before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:25:11.271555+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The fix (adding this class to the deserialization blacklist) was already present in the upstream 2.17.2 release that TuxCare onboarded. The blacklist entry exists in SubTypeValidator.java at line 81, and the validation is actively enforced during bean deserialization via BeanDeserializerFactory. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2018-19362. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The fix (adding this class to the deserialization blacklist) was already present in the upstream 2.17.2 release that TuxCare onboarded. The blacklist entry exists in SubTypeValidator.java at line 81, and the validation is actively enforced during bean deserialization via BeanDeserializerFactory. This is an upstream fix authored by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, exploitable via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.17.2 is not affected because the upstream fix (commit 038b471e2e, issue #1899) was already included in the upstream 2.17.2 release that TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), and the validateSubType method actively enforces this blacklist during deserialization via BeanDeserializerFactory. The fix was authored by Tatu Saloranta (upstream maintainer) and predates the first TuxCare commit (25f42ada38 \"Onboard version 2.17.2\") by 3986 commits, confirming it was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, exploitable via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.17.2 is not affected because the upstream fix (commit 038b471e2e, issue #1899) was already included in the upstream 2.17.2 release that TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 62-63), and the validateSubType method actively enforces this blacklist during deserialization via BeanDeserializerFactory. The fix was authored by Tatu Saloranta (upstream maintainer) and predates the first TuxCare commit (25f42ada38 \"Onboard version 2.17.2\") by 3986 commits, confirming it was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.17.2-tuxcare.3. The c3p0 DataSource deserialization blocking fix was applied by upstream (FasterXML) in commit 6799f8f10c and shipped in the upstream 2.17.2 release. The fix blocks any class under package com.mchange.v2.c3p0. whose name ends with \"DataSource\", preventing exploitation via ComboPooledDataSource and other c3p0 gadgets. TuxCare onboarded an already-fixed upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.17.2-tuxcare.3. The c3p0 DataSource deserialization blocking fix was applied by upstream (FasterXML) in commit 6799f8f10c and shipped in the upstream 2.17.2 release. The fix blocks any class under package com.mchange.v2.c3p0. whose name ends with \"DataSource\", preventing exploitation via ComboPooledDataSource and other c3p0 gadgets. TuxCare onboarded an already-fixed upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to a polymorphic deserialization gadget using the com.mysql.cj.jdbc.admin.MiniAdmin class from mysql-connector-java. The target repository is version 2.17.2-tuxcare.3, which already contains the fix that was shipped in the upstream FasterXML release 2.17.2. The vulnerable gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at line 88 of SubTypeValidator.java, preventing its deserialization even when Default Typing is enabled. The fix commit (dda513bd725) was authored by upstream maintainer Tatu Saloranta and was included in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to a polymorphic deserialization gadget using the com.mysql.cj.jdbc.admin.MiniAdmin class from mysql-connector-java. The target repository is version 2.17.2-tuxcare.3, which already contains the fix that was shipped in the upstream FasterXML release 2.17.2. The vulnerable gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist at line 88 of SubTypeValidator.java, preventing its deserialization even when Default Typing is enabled. The fix commit (dda513bd725) was authored by upstream maintainer Tatu Saloranta and was included in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T18:37:15.512142+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2019-12384. The vulnerability required the absence of a blocklist entry for \"ch.qos.logback.core.db.DriverManagerConnectionSource\" in the SubTypeValidator class. This blocklist entry is present in the target at line 91 of SubTypeValidator.java. The fix was introduced by upstream commit c9ef4a10d6 (author: tatu.saloranta@iki.fi)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2019-12384. The vulnerability required the absence of a blocklist entry for \"ch.qos.logback.core.db.DriverManagerConnectionSource\" in the SubTypeValidator class. This blocklist entry is present in the target at line 91 of SubTypeValidator.java. The fix was introduced by upstream commit c9ef4a10d6 (author: tatu.saloranta@iki.fi)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T07:17:00.105487+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled with JDOM in classpath, allowing arbitrary file reads. The target version 2.17.2-tuxcare.3 is NOT affected because the upstream fix (commit 5f7c69bba0 by Tatu Saloranta) was already present in the upstream 2.17.2 release that TuxCare onboarded. The JDOM XSLTransformer classes are blocklisted in SubTypeValid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled with JDOM in classpath, allowing arbitrary file reads. The target version 2.17.2-tuxcare.3 is NOT affected because the upstream fix (commit 5f7c69bba0 by Tatu Saloranta) was already present in the upstream 2.17.2 release that TuxCare onboarded. The JDOM XSLTransformer classes are blocklisted in SubTypeValid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:12:40.044104+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in jackson-databind 2.17.2-tuxcare.2. The vulnerability concerns deserialization gadget classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that can lead to remote code execution when Jackson's default typing is enabled. The fix adding these classes to the deserialization blacklist was authored by upstream maintainer Tatu Saloranta (commit ad418eeb974) and shipped in the upstream release 2.17.2, predating TuxCare's onboarding. Both dangerous classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 98, 102), and the validateSubType() security check is integrated into Jackson's core deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is not present in jackson-databind 2.17.2-tuxcare.2. The vulnerability concerns deserialization gadget classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that can lead to remote code execution when Jackson's default typing is enabled. The fix adding these classes to the deserialization blacklist was authored by upstream maintainer Tatu Saloranta (commit ad418eeb974) and shipped in the upstream release 2.17.2, predating TuxCare's onboarding. Both dangerous classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 98, 102), and the validateSubType() security check is integrated into Jackson's core deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:06.363098+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not affecting this target. The vulnerability involves polymorphic deserialization of dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that can lead to JNDI injection and remote code execution. The upstream fix adds these classes to a deny-list in SubTypeValidator.java. Analysis shows the fix is already present in the target at lines 98 and 102, introduced by upstream commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b (author: Tatu Saloranta, upstream Jackson maintainer). This fix shipped in upstream release 2.17.2 before TuxCare onboarded the version, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is not affecting this target. The vulnerability involves polymorphic deserialization of dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that can lead to JNDI injection and remote code execution. The upstream fix adds these classes to a deny-list in SubTypeValidator.java. Analysis shows the fix is already present in the target at lines 98 and 102, introduced by upstream commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b (author: Tatu Saloranta, upstream Jackson maintainer). This fix shipped in upstream release 2.17.2 before TuxCare onboarded the version, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind version 2.17.2. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes that could lead to arbitrary code execution. The upstream fix (blocklist entries preventing deserialization of these classes) was already present in upstream release 2.17.2 before TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream Jackson maintainer), not TuxCare. The vulnerable pattern (absence of blocklist protection) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind version 2.17.2. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes that could lead to arbitrary code execution. The upstream fix (blocklist entries preventing deserialization of these classes) was already present in upstream release 2.17.2 before TuxCare onboarded it. The fix was authored by Tatu Saloranta (upstream Jackson maintainer), not TuxCare. The vulnerable pattern (absence of blocklist protection) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:56:28.365878+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 does not affect jackson-databind 2.17.2. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The upstream fix (commit 41b7f9b901, September 2019) added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist, preventing their deserialization. This fix shipped in the upstream release and is present in version 2.17.2 (lines 112-114 of SubTypeValidator.java). The CVE affected versions before 2.9.10/2.8.11.5/2.6.7.3; version 2.17.2 is far beyond these thresholds.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 does not affect jackson-databind 2.17.2. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The upstream fix (commit 41b7f9b901, September 2019) added org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist, preventing their deserialization. This fix shipped in the upstream release and is present in version 2.17.2 (lines 112-114 of SubTypeValidator.java). The CVE affected versions before 2.9.10/2.8.11.5/2.6.7.3; version 2.17.2 is far beyond these thresholds.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 (xalan JNDI gadget polymorphic deserialization) is not present in jackson-databind 2.17.2. The upstream fix (commit 998efd7082 by Tatu Saloranta) added org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist, preventing its deserialization. This fix was already present in the upstream 2.17.2 release that TuxCare onboarded, and the blacklist check is hard-coded in the deserialization path with no way to disable it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 (xalan JNDI gadget polymorphic deserialization) is not present in jackson-databind 2.17.2. The upstream fix (commit 998efd7082 by Tatu Saloranta) added org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blacklist, preventing its deserialization. This fix was already present in the upstream 2.17.2 release that TuxCare onboarded, and the blacklist check is hard-coded in the deserialization path with no way to disable it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:24.314148+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10 due to missing HikariDataSource denylist entry. The target version 2.17.2-tuxcare.3 contains the upstream vendor's fix (commit 73c1c2cc76) that adds \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator denylist. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.17.2, before TuxCare's onboarding. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10 due to missing HikariDataSource denylist entry. The target version 2.17.2-tuxcare.3 contains the upstream vendor's fix (commit 73c1c2cc76) that adds \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator denylist. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.17.2, before TuxCare's onboarding. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability affects jackson-databind 2.0.0 through 2.9.10 and involves polymorphic deserialization gadgets using commons-dbcp datasource classes. The fix (blacklisting org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commit 9593e16cf5 and shipped in upstream version 2.9.10.1. Since the target version 2.17.2 is significantly newer, the fix was already present in the upstream release that TuxCare onboarded via commit 25f42ada38 (authored by ssaprikin@cloudlinux.com on 2026-10-30). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability affects jackson-databind 2.0.0 through 2.9.10 and involves polymorphic deserialization gadgets using commons-dbcp datasource classes. The fix (blacklisting org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commit 9593e16cf5 and shipped in upstream version 2.9.10.1. Since the target version 2.17.2 is significantly newer, the fix was already present in the upstream release that TuxCare onboarded via commit 25f42ada38 (authored by ssaprikin@cloudlinux.com on 2026-10-30). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:16:29.149062+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization of dangerous DataSource classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource) that enable JNDI injection and remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) fixed this by adding these three classes to a deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.17.2 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization of dangerous DataSource classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource) that enable JNDI injection and remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) fixed this by adding these three classes to a deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.17.2 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing issue related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (version 2.17.2-tuxcare.3) already contains the upstream fix that blocks this dangerous class from deserialization. The fix was shipped in the upstream release 2.17.2, which TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic typing issue related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (version 2.17.2-tuxcare.3) already contains the upstream fix that blocks this dangerous class from deserialization. The fix was shipped in the upstream release 2.17.2, which TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:19.112170+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves polymorphic deserialization of log4j-extras gadget classes (JNDIConnectionSource, DriverManagerConnectionSource) that enable JNDI injection attacks. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 from October 2019) added these two classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream 2.17.2 release that TuxCare onboarded, so the vulnerable code pattern does not exist in the target. The blocklist mechanism is actively enforced via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves polymorphic deserialization of log4j-extras gadget classes (JNDIConnectionSource, DriverManagerConnectionSource) that enable JNDI injection attacks. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 from October 2019) added these two classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream 2.17.2 release that TuxCare onboarded, so the vulnerable code pattern does not exist in the target. The blocklist mechanism is actively enforced via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.2-tuxcare.3 is not affected by CVE-2019-20330. The vulnerability requires the absence of blocklist entries for two specific ehcache classes (GenericJndiSelector and GlassfishSelector) that enable unsafe deserialization via JNDI lookups. These blocklist entries were added by upstream author Tatu Saloranta in commit fc4214a883dc087070f25da738ef0d49c2f3387e (November 2019) and were already present in the upstream 2.17.2 release when TuxCare onboarded it (commit 25f42ada38412c02d3c5271e6dd1e02f4ed52461). The vulnerable code pattern (missing blocklist entries) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "Target version 2.17.2-tuxcare.3 is not affected by CVE-2019-20330. The vulnerability requires the absence of blocklist entries for two specific ehcache classes (GenericJndiSelector and GlassfishSelector) that enable unsafe deserialization via JNDI lookups. These blocklist entries were added by upstream author Tatu Saloranta in commit fc4214a883dc087070f25da738ef0d49c2f3387e (November 2019) and were already present in the upstream 2.17.2 release when TuxCare onboarded it (commit 25f42ada38412c02d3c5271e6dd1e02f4ed52461). The vulnerable code pattern (missing blocklist entries) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of JNDI gadget classes (ignite-jta/quartz-core). The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit a424c038ba) was already present in version 2.17.2 when TuxCare onboarded it. The fix adds three classes to the deserialization blocklist: CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider. This blocklist is actively enforced by SubTypeValidator during polymorphic deserialization, preventing the vulnerability from being exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of JNDI gadget classes (ignite-jta/quartz-core). The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT AFFECTED because the upstream fix (commit a424c038ba) was already present in version 2.17.2 when TuxCare onboarded it. The fix adds three classes to the deserialization blocklist: CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider. This blocklist is actively enforced by SubTypeValidator during polymorphic deserialization, preventing the vulnerability from being exploited.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability concerns missing blocklist entries for deserialization gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream release 2.17.2 before TuxCare onboarded it (onboarding commit 25f42ada38). The target code at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 162-164 contains both blocklist entries with the comment \"[databind#2659]: aries.transaction.jms\". The validateSubType method enforces this blocklist at line 269, throwing a JsonMappingException when blocked classes are encountered, effectively preventing the deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability concerns missing blocklist entries for deserialization gadget classes org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream release 2.17.2 before TuxCare onboarded it (onboarding commit 25f42ada38). The target code at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 162-164 contains both blocklist entries with the comment \"[databind#2659]: aries.transaction.jms\". The validateSubType method enforces this blocklist at line 269, throwing a JsonMappingException when blocked classes are encountered, effectively preventing the deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:28:12.870489+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves deserialization gadget class com.caucho.config.types.ResourceRef. The upstream fix (commit 1645efbd39) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.17.2, which TuxCare onboarded. The blacklist entry exists at line 167 and the validation logic at lines 269-303 actively blocks deserialization of this class, preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves deserialization gadget class com.caucho.config.types.ResourceRef. The upstream fix (commit 1645efbd39) added this class to the deserialization blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.17.2, which TuxCare onboarded. The blacklist entry exists at line 167 and the validation logic at lines 269-303 actively blocks deserialization of this class, preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 does not affect jackson-databind 2.17.2-tuxcare.3. The vulnerability involves unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider, but this class is already blocklisted in SubTypeValidator.java (line 171). The fix was committed by upstream maintainer Tatu Saloranta on 2020-03-25 (commit 05d7e0e13f) and was included in the upstream 2.17.2 release (July 2024) that TuxCare onboarded. The target inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 does not affect jackson-databind 2.17.2-tuxcare.3. The vulnerability involves unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider, but this class is already blocklisted in SubTypeValidator.java (line 171). The fix was committed by upstream maintainer Tatu Saloranta on 2020-03-25 (commit 05d7e0e13f) and was included in the upstream 2.17.2 release (July 2024) that TuxCare onboarded. The target inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.2-tuxcare.3 is NOT affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a polymorphic type gadget. The upstream vendor (FasterXML) fixed this in commit 6ba4845798 by adding JEditorPane to the SubTypeValidator blocklist. This fix was already present in upstream release 2.17.2 when TuxCare onboarded it (first TuxCare commit 25f42ada38). The target code at SubTypeValidator.java:150 contains the blocklist entry that prevents JEditorPane deserialization, protecting against the gadget chain exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target version 2.17.2-tuxcare.3 is NOT affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a polymorphic type gadget. The upstream vendor (FasterXML) fixed this in commit 6ba4845798 by adding JEditorPane to the SubTypeValidator blocklist. This fix was already present in upstream release 2.17.2 when TuxCare onboarded it (first TuxCare commit 25f42ada38). The target code at SubTypeValidator.java:150 contains the blocklist entry that prevents JEditorPane deserialization, protecting against the gadget chain exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.activemq.* classes as polymorphic gadgets. The fix (adding these classes to the SubTypeValidator deny-list) was included in the upstream jackson-databind release that TuxCare onboarded. All 9 activemq classes from the upstream patches are present in DEFAULT_NO_DESER_CLASS_NAMES (SubTypeValidator.java lines 173-183). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.17.2 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.activemq.* classes as polymorphic gadgets. The fix (adding these classes to the SubTypeValidator deny-list) was included in the upstream jackson-databind release that TuxCare onboarded. All 9 activemq classes from the upstream patches are present in DEFAULT_NO_DESER_CLASS_NAMES (SubTypeValidator.java lines 173-183). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.17.2 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4, related to deserialization gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the release that TuxCare onboarded. The vulnerable class is blocked in the deny list at SubTypeValidator.java:186, preventing polymorphic deserialization of this dangerous gadget class. Fix commit 05d7e0e13f by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) shipped in the upstream release before TuxCare's first commit (25f42ada38 \"Onboard version 2.17.2\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4, related to deserialization gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the release that TuxCare onboarded. The vulnerable class is blocked in the deny list at SubTypeValidator.java:186, preventing polymorphic deserialization of this dangerous gadget class. Fix commit 05d7e0e13f by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) shipped in the upstream release before TuxCare's first commit (25f42ada38 \"Onboard version 2.17.2\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.2-tuxcare.3 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime via Jackson's polymorphic typing feature. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing instantiation during deserialization. This fix was already present in the upstream 2.17.2 release when TuxCare onboarded it via commit 25f42ada38. The defense is active at line 84 of SubTypeValidator.java and blocks the attack INPUT (JSON with type designator for WASRegistryManagedRuntime) from reaching the GOAL (arbitrary code execution via deserialization gadget).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "Target version 2.17.2-tuxcare.3 is not affected by CVE-2020-11113. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime via Jackson's polymorphic typing feature. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing instantiation during deserialization. This fix was already present in the upstream 2.17.2 release when TuxCare onboarded it via commit 25f42ada38. The defense is active at line 84 of SubTypeValidator.java and blocks the attack INPUT (JSON with type designator for WASRegistryManagedRuntime) from reaching the GOAL (arbitrary code execution via deserialization gadget).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.17.2-tuxcare.3 is not affected by CVE-2020-11619. The fix (blocking deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) was already present in the upstream jackson-databind release that TuxCare onboarded. The fix commit 113e89fb08 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) from April 2020 is an ancestor of TuxCare's onboarding commit, confirming the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target jackson-databind version 2.17.2-tuxcare.3 is not affected by CVE-2020-11619. The fix (blocking deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) was already present in the upstream jackson-databind release that TuxCare onboarded. The fix commit 113e89fb08 by upstream author Tatu Saloranta (tatu.saloranta@iki.fi) from April 2020 is an ancestor of TuxCare's onboarding commit, confirming the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the org.apache.commons.jelly.impl.Embedded deserialization gadget. The target repository (version 2.17.2-tuxcare.3) already contains the fix in SubTypeValidator.java at line 189, which blocks deserialization of this class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 77040d85e3 and was already present in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the org.apache.commons.jelly.impl.Embedded deserialization gadget. The target repository (version 2.17.2-tuxcare.3) already contains the fix in SubTypeValidator.java at line 189, which blocks deserialization of this class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 77040d85e3 and was already present in the upstream 2.17.2 release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves deserialization of the gadget class 'oadd.org.apache.xalan.lib.sql.JNDIConnectionPool' which can lead to JNDI injection and RCE. The fix (blocklist entry for this class in SubTypeValidator.java:192) was introduced by upstream commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921 on April 24, 2020, and was already present in the upstream release 2.17.2 when TuxCare onboarded it. The vulnerable pattern does not exist in the target because the upstream fix shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves deserialization of the gadget class 'oadd.org.apache.xalan.lib.sql.JNDIConnectionPool' which can lead to JNDI injection and RCE. The fix (blocklist entry for this class in SubTypeValidator.java:192) was introduced by upstream commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921 on April 24, 2020, and was already present in the upstream release 2.17.2 when TuxCare onboarded it. The vulnerable pattern does not exist in the target because the upstream fix shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability affects versions before 2.9.10.5, involving deserialization gadgets in oracle.jms.AQjms* classes. The fix (commit 5c8642aeae) adds these five class names to SubTypeValidator's blocklist, preventing their instantiation during polymorphic deserialization. This fix was already included in upstream release 2.10.4 (confirmed by git ancestry analysis) and is present in the target's SubTypeValidator.java at lines 200-204. Since the target version (2.17.2) is much newer than the fixed version, and the fix came from upstream (authored by tatu.saloranta@iki.fi before TuxCare onboarding), the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability affects versions before 2.9.10.5, involving deserialization gadgets in oracle.jms.AQjms* classes. The fix (commit 5c8642aeae) adds these five class names to SubTypeValidator's blocklist, preventing their instantiation during polymorphic deserialization. This fix was already included in upstream release 2.10.4 (confirmed by git ancestry analysis) and is present in the target's SubTypeValidator.java at lines 200-204. Since the target version (2.17.2) is much newer than the fixed version, and the fix came from upstream (authored by tatu.saloranta@iki.fi before TuxCare onboarding), the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.17.2-tuxcare.3 already contains the upstream fix that blocks deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The fix was included in upstream release 2.9.10.5 (commit 840eae2ca81c) and was present when TuxCare onboarded version 2.17.2. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.17.2-tuxcare.3 already contains the upstream fix that blocks deserialization of com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The fix was included in upstream release 2.9.10.5 (commit 840eae2ca81c) and was present when TuxCare onboarded version 2.17.2. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195: Target is not affected. The vulnerability involves jackson-databind allowing deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory, which can lead to remote code execution via JNDI injection. The fix (adding this class to the SubTypeValidator blocklist) is already present in the target at line 207 of SubTypeValidator.java. This fix was introduced by upstream commit f6d9c664f6 authored by Tatu Saloranta and was included in upstream release 2.17.2 before TuxCare onboarded it. The blocklist is actively enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195: Target is not affected. The vulnerability involves jackson-databind allowing deserialization of the gadget class org.jsecurity.realm.jndi.JndiRealmFactory, which can lead to remote code execution via JNDI injection. The fix (adding this class to the SubTypeValidator blocklist) is already present in the target at line 207 of SubTypeValidator.java. This fix was introduced by upstream commit f6d9c664f6 authored by Tatu Saloranta and was included in upstream release 2.17.2 before TuxCare onboarded it. The blocklist is actively enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:20:14.370746+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to missing deny-list entry for the deserialization gadget class \"br.com.anteros.dbcp.AnterosDBCPDataSource\". The target version 2.17.2-tuxcare.3 is NOT vulnerable because the upstream vendor (FasterXML) already added this class to the SubTypeValidator deny-list in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7, which shipped in upstream version 2.9.10.6 (August 2020), long before the 2.17.2 release that TuxCare onboarded. The defense mechanism properly blocks deserialization attempts of this class via the validateSubType method at SubTypeValidator.java:269-303.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to missing deny-list entry for the deserialization gadget class \"br.com.anteros.dbcp.AnterosDBCPDataSource\". The target version 2.17.2-tuxcare.3 is NOT vulnerable because the upstream vendor (FasterXML) already added this class to the SubTypeValidator deny-list in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7, which shipped in upstream version 2.9.10.6 (August 2020), long before the 2.17.2 release that TuxCare onboarded. The defense mechanism properly blocks deserialization attempts of this class via the validateSubType method at SubTypeValidator.java:269-303.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:59.584312+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration which can enable JNDI injection attacks. The fix that blocks this class was committed by upstream maintainer Tatu Saloranta in commit 6cc9f1a1af3 and was already present in upstream version 2.17.2 when TuxCare onboarded it. The defense is implemented in SubTypeValidator.java line 210, which adds the gadget class to DEFAULT_NO_DESER_CLASS_NAMES blocklist. During deserialization, validateSubType() checks incoming type references against this list and reports \"Illegal type to deserialize: prevented for security reasons\" if matched, preventing instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration which can enable JNDI injection attacks. The fix that blocks this class was committed by upstream maintainer Tatu Saloranta in commit 6cc9f1a1af3 and was already present in upstream version 2.17.2 when TuxCare onboarded it. The defense is implemented in SubTypeValidator.java line 210, which adds the gadget class to DEFAULT_NO_DESER_CLASS_NAMES blocklist. During deserialization, validateSubType() checks incoming type references against this list and reports \"Illegal type to deserialize: prevented for security reasons\" if matched, preventing instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.17.2-tuxcare.3. The upstream vendor (FasterXML) fixed this issue in commit 612f971b78 (Fix #2589) which was already included in the upstream 2.17.2 release before TuxCare onboarded it. The fix adds two XML security features to DOMDeserializer.java: (1) disallow-doctype-decl=true to prevent DOCTYPE declarations, (2) load-external-dtd=false to prevent external DTD loading. These protections are present in the target code at lines 40-46 of DOMDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.17.2-tuxcare.3. The upstream vendor (FasterXML) fixed this issue in commit 612f971b78 (Fix #2589) which was already included in the upstream 2.17.2 release before TuxCare onboarded it. The fix adds two XML security features to DOMDeserializer.java: (1) disallow-doctype-decl=true to prevent DOCTYPE declarations, (2) load-external-dtd=false to prevent external DTD loading. These protections are present in the target code at lines 40-46 of DOMDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:21:46.608783+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) that adds these classes to the SubTypeValidator blocklist was already present in jackson-databind 2.17.2 when TuxCare onboarded it. The defense is active at lines 216-219 of SubTypeValidator.java and is enforced through BeanDeserializerFactory during all deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) that adds these classes to the SubTypeValidator blocklist was already present in jackson-databind 2.17.2 when TuxCare onboarded it. The defense is active at lines 216-219 of SubTypeValidator.java and is enforced through BeanDeserializerFactory during all deserialization operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:41:05.137822+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.17.2-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources classes (SharedPoolDataSource and PerUserPoolDataSource) that could enable arbitrary code execution. The upstream fix, which adds these classes to the SubTypeValidator blocklist, was already included in the upstream 2.17.2 release that TuxCare onboarded. The blocklist entries are present at SubTypeValidator.java:217-218, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.17.2-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources classes (SharedPoolDataSource and PerUserPoolDataSource) that could enable arbitrary code execution. The upstream fix, which adds these classes to the SubTypeValidator blocklist, was already included in the upstream 2.17.2 release that TuxCare onboarded. The blocklist entries are present at SubTypeValidator.java:217-218, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:51.888467+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.17.2-tuxcare.3. The fix was already included in the upstream release 2.17.2 before TuxCare onboarded it. The gadget class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is present in the deserialization blocklist at SubTypeValidator.java:240, preventing exploitation of this JNDI injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.17.2-tuxcare.3. The fix was already included in the upstream release 2.17.2 before TuxCare onboarded it. The gadget class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is present in the deserialization blocklist at SubTypeValidator.java:240, preventing exploitation of this JNDI injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:24:51.671524+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability relates to deserialization gadgets involving oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. The upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in the upstream 2.17.2 release that TuxCare onboarded. The SubTypeValidator blocklist at line 193 includes the dangerous class name, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability relates to deserialization gadgets involving oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. The upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in the upstream 2.17.2 release that TuxCare onboarded. The SubTypeValidator blocklist at line 193 includes the dangerous class name, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:35:29.309896+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves missing blocklist entries for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes that could enable JNDI injection attacks via polymorphic deserialization. The upstream fix (commit 3ded28aece) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already included in upstream release 2.17.2, which TuxCare onboarded. All five DriverAdapterCPDS variant entries are present in the target at SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involves missing blocklist entries for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes that could enable JNDI injection attacks via polymorphic deserialization. The upstream fix (commit 3ded28aece) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already included in upstream release 2.17.2, which TuxCare onboarded. All five DriverAdapterCPDS variant entries are present in the target at SubTypeValidator.java lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:41:53.192155+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT affected by CVE-2020-36181. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.17.2 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are present in the SubTypeValidator blocklist at lines 123, 193, 219, 228, and 234, preventing their deserialization. This is an upstream fix that shipped with the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target repository (jackson-databind 2.17.2-tuxcare.3) is NOT affected by CVE-2020-36181. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS and related DBCP gadget classes. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.17.2 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are present in the SubTypeValidator blocklist at lines 123, 193, 219, 228, and 234, preventing their deserialization. This is an upstream fix that shipped with the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:59.877228+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.17.2-tuxcare.3. The upstream fix by Tatu Saloranta (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b, dated Dec 31 2020) was already included in the jackson-databind 2.17.2 release when TuxCare onboarded it on the tuxcare-current/2.17.2 branch. The CVE affects versions before 2.9.10.8; version 2.17.2 is significantly newer and already contains the blocklist entries for all DriverAdapterCPDS gadget class variants in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.17.2-tuxcare.3. The upstream fix by Tatu Saloranta (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b, dated Dec 31 2020) was already included in the jackson-databind 2.17.2 release when TuxCare onboarded it on the tuxcare-current/2.17.2 branch. The CVE affects versions before 2.9.10.8; version 2.17.2 is significantly newer and already contains the blocklist entries for all DriverAdapterCPDS gadget class variants in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:21:12.185577+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability relates to unsafe deserialization of the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 12e23c962f by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream release 2.17.2 before TuxCare onboarded the version, making the target not affected from the start.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability relates to unsafe deserialization of the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 12e23c962f by Tatu Saloranta) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream release 2.17.2 before TuxCare onboarded the version, making the target not affected from the start.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2 datasource classes that can be exploited as deserialization gadgets. The target version 2.17.2-tuxcare.2 already contains the upstream fix (commit 567194c53a by Tatu Saloranta) that was included in the original 2.17.2 release. The fix adds the vulnerable classes to the DEFAULT_NO_DESER_CLASS_NAMES deny list in SubTypeValidator.java (lines 232-236), preventing their deserialization. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2 datasource classes that can be exploited as deserialization gadgets. The target version 2.17.2-tuxcare.2 already contains the upstream fix (commit 567194c53a by Tatu Saloranta) that was included in the original 2.17.2 release. The fix adds the vulnerable classes to the DEFAULT_NO_DESER_CLASS_NAMES deny list in SubTypeValidator.java (lines 232-236), preventing their deserialization. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:01.860590+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability concerned unsafe deserialization of `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource` gadget classes. The upstream fix (commit 567194c53ae by Tatu Saloranta, 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix shipped in upstream release 2.17.2, which TuxCare onboarded in commit 25f42ada38. The target code contains the complete fix at lines 232-236 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability concerned unsafe deserialization of `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource` gadget classes. The upstream fix (commit 567194c53ae by Tatu Saloranta, 2020-12-26) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix shipped in upstream release 2.17.2, which TuxCare onboarded in commit 25f42ada38. The target code contains the complete fix at lines 232-236 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:31:59.864465+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target is not affected by CVE-2020-36186. The vulnerable class org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource is already blocklisted in SubTypeValidator.java (line 229), preventing its deserialization. This fix was included in the upstream jackson-databind 2.17.2 release (commit 3e8fa3beea authored by tatu.saloranta@iki.fi) before TuxCare onboarded the version. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "Target is not affected by CVE-2020-36186. The vulnerable class org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource is already blocklisted in SubTypeValidator.java (line 229), preventing its deserialization. This fix was included in the upstream jackson-databind 2.17.2 release (commit 3e8fa3beea authored by tatu.saloranta@iki.fi) before TuxCare onboarded the version. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:45:46.897208+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target repository version 2.17.2-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) was already included in the upstream 2.17.2 release before TuxCare onboarded it. The fix adds these two classes to the SubTypeValidator blocklist at lines 229-230, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target repository version 2.17.2-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) was already included in the upstream 2.17.2 release before TuxCare onboarded it. The fix adds these two classes to the SubTypeValidator blocklist at lines 229-230, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:51:12.642270+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.17.2. The fix was already included in the upstream 2.17.2 release. The gadget classes `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource` and `DriverManagerConnectionSource` are blocked in SubTypeValidator.java lines 223-224, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 33d96c13fe and was present before TuxCare onboarded version 2.17.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.17.2. The fix was already included in the upstream 2.17.2 release. The gadget classes `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource` and `DriverManagerConnectionSource` are blocked in SubTypeValidator.java lines 223-224, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 33d96c13fe and was present before TuxCare onboarded version 2.17.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.17.2-tuxcare.2. The fix was already included in the upstream 2.17.2 release. The vulnerable classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blocked in SubTypeValidator.java lines 223-224, preventing unsafe deserialization. The CVE affects versions before 2.9.10.8; version 2.17.2 is well after the fixed version and includes the upstream patch by Tatu Saloranta (commit 33d96c13fe, Dec 26 2020).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.17.2-tuxcare.2. The fix was already included in the upstream 2.17.2 release. The vulnerable classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blocked in SubTypeValidator.java lines 223-224, preventing unsafe deserialization. The CVE affects versions before 2.9.10.8; version 2.17.2 is well after the fixed version and includes the upstream patch by Tatu Saloranta (commit 33d96c13fe, Dec 26 2020).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:16:00.456035+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 describes a stack overflow DoS vulnerability in jackson-databind caused by deeply nested JSON objects/arrays. The target version 2.17.2-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) replaced the vulnerable recursive deserialization implementation with a non-recursive iterative approach (UntypedObjectDeserializerNR) that eliminates stack overflow risk entirely. This fix was already present in upstream version 2.17.2 when TuxCare onboarded it, so the vulnerable code pattern has never existed in any TuxCare release of 2.17.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 describes a stack overflow DoS vulnerability in jackson-databind caused by deeply nested JSON objects/arrays. The target version 2.17.2-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) replaced the vulnerable recursive deserialization implementation with a non-recursive iterative approach (UntypedObjectDeserializerNR) that eliminates stack overflow risk entirely. This fix was already present in upstream version 2.17.2 when TuxCare onboarded it, so the vulnerable code pattern has never existed in any TuxCare release of 2.17.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:03.643431+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.17.2-tuxcare.3) is NOT vulnerable to CVE-2020-8840. The vulnerability requires deserializing org.apache.xbean.propertyeditor.JndiConverter via polymorphic type handling, enabling JNDI injection attacks. This class is blocked in SubTypeValidator.java line 138 within DEFAULT_NO_DESER_CLASS_NAMES. The fix (commit 914e7c9f2cb by upstream maintainer Tatu Saloranta, 2020-02-09) was already present in upstream release 2.17.2 before TuxCare onboarding (first TuxCare commit 25f42ada384 \"Onboard version 2.17.2\"). The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). Verdict: not_affected (upstream vendor fix, not TuxCare backport).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target (jackson-databind 2.17.2-tuxcare.3) is NOT vulnerable to CVE-2020-8840. The vulnerability requires deserializing org.apache.xbean.propertyeditor.JndiConverter via polymorphic type handling, enabling JNDI injection attacks. This class is blocked in SubTypeValidator.java line 138 within DEFAULT_NO_DESER_CLASS_NAMES. The fix (commit 914e7c9f2cb by upstream maintainer Tatu Saloranta, 2020-02-09) was already present in upstream release 2.17.2 before TuxCare onboarding (first TuxCare commit 25f42ada384 \"Onboard version 2.17.2\"). The blocklist is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). Verdict: not_affected (upstream vendor fix, not TuxCare backport).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.2-tuxcare.3 is NOT AFFECTED by CVE-2020-9546. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which can lead to arbitrary code execution. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) adding HikariConfig to SubTypeValidator's denylist was already present in the upstream 2.17.2 release that TuxCare onboarded. The defense is active: SubTypeValidator.validateSubType() checks incoming type names against DEFAULT_NO_DESER_CLASS_NAMES and throws JsonMappingException (\"Illegal type to deserialize: prevented for security reasons\") when HikariConfig is detected, blocking the attack before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "Target jackson-databind 2.17.2-tuxcare.3 is NOT AFFECTED by CVE-2020-9546. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which can lead to arbitrary code execution. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) adding HikariConfig to SubTypeValidator's denylist was already present in the upstream 2.17.2 release that TuxCare onboarded. The defense is active: SubTypeValidator.validateSubType() checks incoming type names against DEFAULT_NO_DESER_CLASS_NAMES and throws JsonMappingException (\"Illegal type to deserialize: prevented for security reasons\") when HikariConfig is detected, blocking the attack before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:41:47.392844+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to missing blocklist entry for the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.17.2 is NOT AFFECTED because the upstream vendor fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2, authored by Tatu Saloranta on Feb 29, 2020) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was part of the upstream 2.17.2 release that TuxCare onboarded, not a TuxCare backport. The blocklist entry at line 144 prevents instantiation of this gadget class during polymorphic deserialization, blocking the attack chain before exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7 due to missing blocklist entry for the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The target version 2.17.2 is NOT AFFECTED because the upstream vendor fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2, authored by Tatu Saloranta on Feb 29, 2020) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was part of the upstream 2.17.2 release that TuxCare onboarded, not a TuxCare backport. The blocklist entry at line 144 prevents instantiation of this gadget class during polymorphic deserialization, blocking the attack chain before exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:06.348166+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The target version 2.17.2 already contains the upstream fix: the malicious class is blocked in SubTypeValidator.java line 145, added by upstream commits 9f4e97019f and 1e64db6a2f in the 2.17.2 release (before TuxCare onboarding). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The target version 2.17.2 already contains the upstream fix: the malicious class is blocked in SubTypeValidator.java line 145, added by upstream commits 9f4e97019f and 1e64db6a2f in the 2.17.2 release (before TuxCare onboarding). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:50.465041+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7. The vulnerability involves deserialization gadgets, specifically the ability to instantiate dangerous classes like javax.swing.JTextPane during polymorphic type handling. The target repository at version 2.17.2-tuxcare.3 is NOT AFFECTED because the fix (blocking javax.swing.JTextPane) was already present in the upstream jackson-databind 2.17.2 release. The fix was authored by upstream maintainer Tatu Saloranta in September 2020 (commit 7dbf51bf78) and is included in all subsequent releases, including 2.17.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7. The vulnerability involves deserialization gadgets, specifically the ability to instantiate dangerous classes like javax.swing.JTextPane during polymorphic type handling. The target repository at version 2.17.2-tuxcare.3 is NOT AFFECTED because the fix (blocking javax.swing.JTextPane) was already present in the upstream jackson-databind 2.17.2 release. The fix was authored by upstream maintainer Tatu Saloranta in September 2020 (commit 7dbf51bf78) and is included in all subsequent releases, including 2.17.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2021-46877. The upstream vendor (FasterXML) fixed this DoS vulnerability in commit 3ccde7d938 (December 2021), which shipped in upstream releases 2.12.6 and 2.13.1. Since the target is version 2.17.2 (released May 2024), the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (direct allocation based on untrusted deserialized length) has been replaced with chunked buffering that limits eager allocation to 100KB, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "The target jackson-databind 2.17.2-tuxcare.3 is not affected by CVE-2021-46877. The upstream vendor (FasterXML) fixed this DoS vulnerability in commit 3ccde7d938 (December 2021), which shipped in upstream releases 2.12.6 and 2.13.1. Since the target is version 2.17.2 (released May 2024), the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (direct allocation based on untrusted deserialized length) has been replaced with chunked buffering that limits eager allocation to 100KB, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:45:07.357611+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involved resource exhaustion from deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, due to missing validation in primitive value deserializers and BeanDeserializer. The upstream fix (commit d78d00ee7b) was already included in the 2.17.2 release that TuxCare onboarded. Both StdDeserializer (primitives) and BeanDeserializer have the handleNestedArrayForSingle() defense that detects second-level array nesting and rejects it before recursive processing. Since the fix was authored by upstream (tatu.saloranta@iki.fi) and predates the first TuxCare commit (onboarding 25f42ada38), this is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 is not present in jackson-databind 2.17.2-tuxcare.3. The vulnerability involved resource exhaustion from deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, due to missing validation in primitive value deserializers and BeanDeserializer. The upstream fix (commit d78d00ee7b) was already included in the 2.17.2 release that TuxCare onboarded. Both StdDeserializer (primitives) and BeanDeserializer have the handleNestedArrayForSingle() defense that detects second-level array nesting and rejects it before recursive processing. Since the fix was authored by upstream (tatu.saloranta@iki.fi) and predates the first TuxCare commit (onboarding 25f42ada38), this is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:58:07.747368+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 describes a resource exhaustion vulnerability in jackson-databind when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, caused by unbounded recursive processing of deeply nested JSON arrays. The target version 2.17.2-tuxcare.3 is not affected because the upstream fix (commit 063183589 by Tatu Saloranta) was already present in the upstream release 2.17.2 that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject nested arrays after the first wrapper level.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 describes a resource exhaustion vulnerability in jackson-databind when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, caused by unbounded recursive processing of deeply nested JSON arrays. The target version 2.17.2-tuxcare.3 is not affected because the upstream fix (commit 063183589 by Tatu Saloranta) was already present in the upstream release 2.17.2 that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject nested arrays after the first wrapper level.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:19:00.068472+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.17.2 is not affected by CVE-2026-50193. The vulnerability involved stack overflow when serializing deeply nested JsonNode structures via recursive method calls. The upstream fix (commit a1fa4ae4ec, May 2022) converted the recursive serialization to an iterative approach using an explicit IteratorStack, eliminating the stack overflow risk. This fix was introduced in upstream ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 Target version 2.17.2 is not affected by CVE-2026-50193. The vulnerability involved stack overflow when serializing deeply nested JsonNode structures via recursive method calls. The upstream fix (commit a1fa4ae4ec, May 2022) converted the recursive serialization to an iterative approach using an explicit IteratorStack, eliminating the stack overflow risk. This fix was introduced in upstream ver..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:21:00.146665+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.17.2-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.17.2-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T02:05:23.844457+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.17.2 is not affected by CVE-2026-54518. The vulnerability exists in the `processUnwrappedCreatorProperties()` method which was introduced in version 2.19.0 as part of feature #1467 (commit 502fe888da). Version 2.17.2 explicitly rejects the combination of @JsonUnwrapped with @JsonCreator parameters, throwing an exception with the message \"Cannot define Creator parameter ... as @...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Target version 2.17.2 is not affected by CVE-2026-54518. The vulnerability exists in the `processUnwrappedCreatorProperties()` method which was introduced in version 2.19.0 as part of feature #1467 (commit 502fe888da). Version 2.17.2 explicitly rejects the combination of @JsonUnwrapped with @JsonCreator parameters, throwing an exception with the message \"Cannot define Creator parameter ... as @..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:53:00.124109+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.17.2-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T13:52:37.542032+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.17.2-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}