{
  "@id": "urn:uuid:0377a45a-6383-4828-a5aa-5df994d6be05",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 61,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:17:33.879237+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:11.201920+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability allowed remote code execution via deserialization of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 types). The upstream vendor (FasterXML) fixed this in commits ddfddfba64 and e865a7a446 by adding these classes to a deserialization blacklist. These fixes were already included in the upstream 2.18.5 release that TuxCare onboarded, not applied as a TuxCare backport. The blacklist is present in SubTypeValidator.java and enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability allowed remote code execution via deserialization of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 types). The upstream vendor (FasterXML) fixed this in commits ddfddfba64 and e865a7a446 by adding these classes to a deserialization blacklist. These fixes were already included in the upstream 2.18.5 release that TuxCare onboarded, not applied as a TuxCare backport. The blacklist is present in SubTypeValidator.java and enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is NOT present in jackson-databind 2.18.5. The vulnerability concerns an incomplete blacklist for polymorphic deserialization that allowed remote code execution via dangerous classes (Spring, C3P0, JDK types). The fixes for issues #1737 and #1855 were already included in the upstream release 2.18.5 when TuxCare onboarded it. The target contains SubTypeValidator with the complete blacklist (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring classes, C3P0 DataSources, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader) and sophisticated Spring/C3P0 superclass checking logic. All fix commits (2235894210, bb45fb1670, e865a7a446, f031f27a31) were authored by upstream developers (tatu.saloranta@iki.fi, andrew.tolbert@datastax.com), not TuxCare, and are ancestors of the onboarding commit 66469eba02.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is NOT present in jackson-databind 2.18.5. The vulnerability concerns an incomplete blacklist for polymorphic deserialization that allowed remote code execution via dangerous classes (Spring, C3P0, JDK types). The fixes for issues #1737 and #1855 were already included in the upstream release 2.18.5 when TuxCare onboarded it. The target contains SubTypeValidator with the complete blacklist (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring classes, C3P0 DataSources, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader) and sophisticated Spring/C3P0 superclass checking logic. All fix commits (2235894210, bb45fb1670, e865a7a446, f031f27a31) were authored by upstream developers (tatu.saloranta@iki.fi, andrew.tolbert@datastax.com), not TuxCare, and are ancestors of the onboarding commit 66469eba02.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:37:48.238689+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.18.5 is not affected by CVE-2017-7525. The vulnerability (deserialization of dangerous classes enabling arbitrary code execution) is mitigated by the SubTypeValidator defense mechanism that shipped in the upstream 2.18.5 release. This validation blocks all dangerous classes (InvokerTransformer, TemplatesImpl, etc.) referenced in the CVE-2017-7525 patches before deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "Target jackson-databind version 2.18.5 is not affected by CVE-2017-7525. The vulnerability (deserialization of dangerous classes enabling arbitrary code execution) is mitigated by the SubTypeValidator defense mechanism that shipped in the upstream 2.18.5 release. This validation blocks all dangerous classes (InvokerTransformer, TemplatesImpl, etc.) referenced in the CVE-2017-7525 patches before deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:24:51.671524+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.5 is not affected by CVE-2018-11307. The upstream fix (blacklisting org.apache.ibatis.parsing.XPathParser) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc270 on 2018-05-10, which shipped in upstream release 2.7.9.4. Version 2.18.5 (released years later) includes this fix as part of the upstream codebase that TuxCare onboarded. The vulnerable pattern (absence of blacklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "Target version 2.18.5 is not affected by CVE-2018-11307. The upstream fix (blacklisting org.apache.ibatis.parsing.XPathParser) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc270 on 2018-05-10, which shipped in upstream release 2.7.9.4. Version 2.18.5 (released years later) includes this fix as part of the upstream codebase that TuxCare onboarded. The vulnerable pattern (absence of blacklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 describes a deserialization vulnerability in jackson-databind when Default Typing is enabled, allowing arbitrary code execution via JNDI/LDAP injection through Jodd-db and Oracle JDBC gadget classes. The target repository jackson-databind 2.18.5-tuxcare.3 contains the upstream fix that blacklists the three dangerous classes in SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream vendor) in commit 28badf7ef6 and was already present in the upstream 2.18.5 release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 describes a deserialization vulnerability in jackson-databind when Default Typing is enabled, allowing arbitrary code execution via JNDI/LDAP injection through Jodd-db and Oracle JDBC gadget classes. The target repository jackson-databind 2.18.5-tuxcare.3 contains the upstream fix that blacklists the three dangerous classes in SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream vendor) in commit 28badf7ef6 and was already present in the upstream 2.18.5 release that TuxCare onboarded. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:27:00.867186+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability allowed polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) leading to JNDI/LDAP-based remote code execution. The target contains the upstream fix: both Oracle JDBC classes are blacklisted in SubTypeValidator.java (lines 71-72), blocking their deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 28badf7ef6 and was already present in upstream jackson-databind 2.18.5 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability allowed polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) leading to JNDI/LDAP-based remote code execution. The target contains the upstream fix: both Oracle JDBC classes are blacklisted in SubTypeValidator.java (lines 71-72), blocking their deserialization. This fix was authored by Tatu Saloranta (upstream maintainer) in commit 28badf7ef6 and was already present in upstream jackson-databind 2.18.5 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:04:00.565154+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns polymorphic deserialization of the slf4j-ext class (org.slf4j.ext.EventData) which could lead to arbitrary code execution. The upstream fix commit 87d29af25e (authored by Tatu Saloranta) added org.slf4j.ext.EventData to the deserialization blocklist and was already present in upstream version 2.18.5 when TuxCare onboarded it. The blocklist is actively enforced in SubTypeValidator.java and blocks deserialization with a security error message.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns polymorphic deserialization of the slf4j-ext class (org.slf4j.ext.EventData) which could lead to arbitrary code execution. The upstream fix commit 87d29af25e (authored by Tatu Saloranta) added org.slf4j.ext.EventData to the deserialization blocklist and was already present in upstream version 2.18.5 when TuxCare onboarded it. The blocklist is actively enforced in SubTypeValidator.java and blocks deserialization with a security error message.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 by allowing remote code execution through polymorphic deserialization of blaze-ds-opt and blaze-ds-core classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes). The target repository at version 2.18.5-tuxcare.3 is NOT affected because the upstream fix (commit 87d29af25e) was already present in the upstream release 2.18.5 before TuxCare onboarded it. The fix blocks dangerous classes including \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 74-78), which is actively invoked during bean deserialization via BeanDeserializerFactory._validateSubType() at line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 by allowing remote code execution through polymorphic deserialization of blaze-ds-opt and blaze-ds-core classes (specifically flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes). The target repository at version 2.18.5-tuxcare.3 is NOT affected because the upstream fix (commit 87d29af25e) was already present in the upstream release 2.18.5 before TuxCare onboarded it. The fix blocks dangerous classes including \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 74-78), which is actively invoked during bean deserialization via BeanDeserializerFactory._validateSubType() at line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:11:33.363226+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability involves polymorphic deserialization of dangerous JDK classes that can enable XXE attacks. The fix\u2014adding four class names (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to a deserialization blocklist\u2014was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in upstream release 2.18.5 before TuxCare onboarded it. The blocklist is enforced by SubTypeValidator.validateSubType() during bean deserialization, preventing instantiation of these classes. CVE affects \"2.x before 2.9.7\"; target version 2.18.5 is well after this threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target jackson-databind version 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. The vulnerability involves polymorphic deserialization of dangerous JDK classes that can enable XXE attacks. The fix\u2014adding four class names (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) to a deserialization blocklist\u2014was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in upstream release 2.18.5 before TuxCare onboarded it. The blocklist is enforced by SubTypeValidator.validateSubType() during bean deserialization, preventing instantiation of these classes. CVE affects \"2.x before 2.9.7\"; target version 2.18.5 is well after this threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:41:24.721852+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7, enabling SSRF attacks through polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target version 2.18.5 is not affected because the upstream vendor (FasterXML) added this class to the deserialization blocklist in commit 87d29af25e (Fix #2097), which shipped in upstream release 2.18.5 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:78 and is enforced by validateSubType() which throws a security exception when blocked classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7, enabling SSRF attacks through polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The target version 2.18.5 is not affected because the upstream vendor (FasterXML) added this class to the deserialization blocklist in commit 87d29af25e (Fix #2097), which shipped in upstream release 2.18.5 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:78 and is enforced by validateSubType() which throws a security exception when blocked classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.18.5. The vulnerability concerns the failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. The fix (adding this class to the SubTypeValidator blacklist) was already present in upstream version 2.18.5 when TuxCare onboarded it. The target repository contains the complete defense at line 85 of SubTypeValidator.java, which prevents instantiation of the dangerous class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.18.5. The vulnerability concerns the failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. The fix (adding this class to the SubTypeValidator blacklist) was already present in upstream version 2.18.5 when TuxCare onboarded it. The target repository contains the complete defense at line 85 of SubTypeValidator.java, which prevents instantiation of the dangerous class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:58.617275+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5-tuxcare.3 is NOT affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of openjpa classes that can lead to remote code execution. The vendor fix (adding org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the deserialization blacklist) was already present in the upstream 2.18.5 release before TuxCare onboarding. The blacklist entries exist at SubTypeValidator.java lines 82-84, and the validation is enforced unconditionally during bean deserialization at BeanDeserializerFactory.java line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "The target jackson-databind 2.18.5-tuxcare.3 is NOT affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of openjpa classes that can lead to remote code execution. The vendor fix (adding org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the deserialization blacklist) was already present in the upstream 2.18.5 release before TuxCare onboarding. The blacklist entries exist at SubTypeValidator.java lines 82-84, and the validation is enforced unconditionally during bean deserialization at BeanDeserializerFactory.java line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2018-19362. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in upstream release 2.18.5 before TuxCare onboarded it. The fix adds \"org.jboss.util.propertyeditor.DocumentEditor\" and related dangerous classes to the SubTypeValidator blocklist, preventing polymorphic deserialization attacks. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2018-19362. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in upstream release 2.18.5 before TuxCare onboarded it. The fix adds \"org.jboss.util.propertyeditor.DocumentEditor\" and related dangerous classes to the SubTypeValidator blocklist, preventing polymorphic deserialization attacks. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.18.5. The vulnerability concerns two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve RCE. The upstream vendor (Tatu Saloranta) fixed this in commit 038b471e2e by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.5 release that TuxCare onboarded, so the target has never been vulnerable to this specific CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.18.5. The vulnerability concerns two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve RCE. The upstream vendor (Tatu Saloranta) fixed this in commit 038b471e2e by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.5 release that TuxCare onboarded, so the target has never been vulnerable to this specific CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:29.897304+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2018-7489. The vulnerability (c3p0 gadget deserialization enabling RCE) was fixed by upstream maintainer Tatu Saloranta in commit 6799f8f10c, released in version 2.7.9.3 (February 2018). This fix was part of the upstream release before TuxCare onboarded version 2.18.5. The c3p0 blocking logic is present in SubTypeValidator.java lines 288-298, preventing deserialization of dangerous c3p0 DataSource classes that match the pattern com.mchange.v2.c3p0.*DataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2018-7489. The vulnerability (c3p0 gadget deserialization enabling RCE) was fixed by upstream maintainer Tatu Saloranta in commit 6799f8f10c, released in version 2.7.9.3 (February 2018). This fix was part of the upstream release before TuxCare onboarded version 2.18.5. The c3p0 blocking logic is present in SubTypeValidator.java lines 288-298, preventing deserialization of dangerous c3p0 DataSource classes that match the pattern com.mchange.v2.c3p0.*DataSource.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:37:30.400386+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.18.5-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in May 2019 by adding com.mysql.cj.jdbc.admin.MiniAdmin to the deserialization blocklist in SubTypeValidator. This fix was already present in the upstream release 2.9.9 and all subsequent versions including 2.18.5, which TuxCare onboarded. The vulnerable pattern (missing validation of MiniAdmin during polymorphic deserialization) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.18.5-tuxcare.3. The upstream vendor (FasterXML) fixed this vulnerability in May 2019 by adding com.mysql.cj.jdbc.admin.MiniAdmin to the deserialization blocklist in SubTypeValidator. This fix was already present in the upstream release 2.9.9 and all subsequent versions including 2.18.5, which TuxCare onboarded. The vulnerable pattern (missing validation of MiniAdmin during polymorphic deserialization) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T18:53:00.171889+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to failure to block ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization. The target version 2.18.5-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in version 2.9.9.1 (June 2019), and the fix was already present in the upstream 2.18.5 release that TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to failure to block ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization. The target version 2.18.5-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) fixed this vulnerability in version 2.9.9.1 (June 2019), and the fix was already present in the upstream 2.18.5 release that TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T07:35:00.435715+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that could allow arbitrary file reads. The upstream fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeVa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that could allow arbitrary file reads. The upstream fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeVa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT affecting jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could lead to RCE via deserialization with default typing enabled. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 (July 2019) by adding both classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.5 when TuxCare onboarded it (commit 66469eba02 by evasilev@cloudlinux.com). The target's SubTypeValidator.java contains both blacklist entries (lines 98, 102), and the validation mechanism (line 269) properly blocks deserialization of these classes during the JSON parsing path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT affecting jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns missing blacklist entries for dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could lead to RCE via deserialization with default typing enabled. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 (July 2019) by adding both classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.18.5 when TuxCare onboarded it (commit 66469eba02 by evasilev@cloudlinux.com). The target's SubTypeValidator.java contains both blacklist entries (lines 98, 102), and the validation mechanism (line 269) properly blocks deserialization of these classes during the JSON parsing path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:07.796693+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5-tuxcare.3 contains the fix for CVE-2019-14439. The vendor patch adds blacklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) to SubTypeValidator.java, preventing their deserialization during polymorphic typing. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.18.5 release that TuxCare onboarded. The vulnerable pattern is not present due to this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "The target jackson-databind 2.18.5-tuxcare.3 contains the fix for CVE-2019-14439. The vendor patch adds blacklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) to SubTypeValidator.java, preventing their deserialization during polymorphic typing. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream 2.18.5 release that TuxCare onboarded. The vulnerable pattern is not present due to this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:52:51.215173+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns polymorphic deserialization gadgets (com.zaxxer.hikari.HikariConfig and HikariDataSource) that could enable arbitrary code execution. The upstream fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was already included in version 2.18.5 when TuxCare onboarded it. Both fix commits (73c1c2cc76 and d4983c740f) by upstream maintainer Tatu Saloranta are ancestors of the first TuxCare onboarding commit (66469eba02). The blocklist entries are active by default and prevent instantiation of these dangerous types during JSON deserialization with polymorphic typing enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns polymorphic deserialization gadgets (com.zaxxer.hikari.HikariConfig and HikariDataSource) that could enable arbitrary code execution. The upstream fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was already included in version 2.18.5 when TuxCare onboarded it. Both fix commits (73c1c2cc76 and d4983c740f) by upstream maintainer Tatu Saloranta are ancestors of the first TuxCare onboarding commit (66469eba02). The blocklist entries are active by default and prevent instantiation of these dangerous types during JSON deserialization with polymorphic typing enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:48.562174+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is not present in jackson-databind 2.18.5. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The fix, which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist, was authored by upstream maintainer Tatu Saloranta in commit 41b7f9b901 (Sept 2019) and was already present in the upstream 2.18.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is not present in jackson-databind 2.18.5. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The fix, which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blocklist, was authored by upstream maintainer Tatu Saloranta in commit 41b7f9b901 (Sept 2019) and was already present in the upstream 2.18.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in the target. The vulnerability involves polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The upstream vendor fix (commit 998efd7082 by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already shipped in upstream jackson-databind 2.18.5, which TuxCare then onboarded (commit 66469eba02). The vulnerable pattern (unblocked deserialization of the xalan gadget) is absent from the target codebase at HEAD (b0a1248662). Target version: 2.18.5-tuxcare.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in the target. The vulnerability involves polymorphic deserialization of malicious objects using the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The upstream vendor fix (commit 998efd7082 by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already shipped in upstream jackson-databind 2.18.5, which TuxCare then onboarded (commit 66469eba02). The vulnerable pattern (unblocked deserialization of the xalan gadget) is absent from the target codebase at HEAD (b0a1248662). Target version: 2.18.5-tuxcare.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:41.975072+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is a polymorphic deserialization vulnerability related to com.zaxxer.hikari.HikariDataSource in jackson-databind. The target repository (jackson-databind 2.18.5-tuxcare.3) is not affected because the upstream fix was already present in version 2.18.5 before TuxCare onboarding. The fix adds HikariDataSource to the deserialization blocklist in SubTypeValidator.java, preventing exploitation of this gadget class through polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is a polymorphic deserialization vulnerability related to com.zaxxer.hikari.HikariDataSource in jackson-databind. The target repository (jackson-databind 2.18.5-tuxcare.3) is not affected because the upstream fix was already present in version 2.18.5 before TuxCare onboarding. The fix adds HikariDataSource to the deserialization blocklist in SubTypeValidator.java, preventing exploitation of this gadget class through polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:46.829367+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.5-tuxcare.3) is NOT vulnerable to CVE-2019-16942. The vulnerability allowed arbitrary code execution via deserialization of dangerous commons-dbcp datasource classes (SharedPoolDataSource and PerUserPoolDataSource) when polymorphic typing is enabled. The upstream fix was already present in version 2.18.5 when TuxCare onboarded it. Both dangerous classes are blocked in SubTypeValidator.java at lines 124-125, preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before any TuxCare involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.5-tuxcare.3) is NOT vulnerable to CVE-2019-16942. The vulnerability allowed arbitrary code execution via deserialization of dangerous commons-dbcp datasource classes (SharedPoolDataSource and PerUserPoolDataSource) when polymorphic typing is enabled. The upstream fix was already present in version 2.18.5 when TuxCare onboarded it. Both dangerous classes are blocked in SubTypeValidator.java at lines 124-125, preventing their deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before any TuxCare involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:21:23.053995+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) leading to RCE. The upstream fix, authored by Tatu Saloranta in commit 9593e16cf5 (Sept 2019), added these classes to SubTypeValidator's blocklist (DEFAULT_NO_DESER_CLASS_NAMES). This fix shipped in upstream version 2.9.10.1 and all subsequent releases including 2.18.5. The target contains the complete blocklist at SubTypeValidator.java:124-127, blocking all three CVE-2019-16943 gadgets. The fix predates TuxCare's onboarding of version 2.18.5 (commit 66469eba02 by evasilev@cloudlinux.com), confirming it arrived via the upstream release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) leading to RCE. The upstream fix, authored by Tatu Saloranta in commit 9593e16cf5 (Sept 2019), added these classes to SubTypeValidator's blocklist (DEFAULT_NO_DESER_CLASS_NAMES). This fix shipped in upstream version 2.9.10.1 and all subsequent releases including 2.18.5. The target contains the complete blocklist at SubTypeValidator.java:124-127, blocking all three CVE-2019-16943 gadgets. The fix predates TuxCare's onboarding of version 2.18.5 (commit 66469eba02 by evasilev@cloudlinux.com), confirming it arrived via the upstream release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2019-17267. The fix for this polymorphic deserialization gadget vulnerability (blacklisting net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in SubTypeValidator) was already present in the upstream jackson-databind 2.18.5 release when TuxCare onboarded it. The blacklist entry preventing exploitation appears at SubTypeValidator.java:99. Fix commit 191a4cdf87 by upstream maintainer tatu.saloranta@iki.fi predates TuxCare's onboarding commit, confirming this is an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "Target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2019-17267. The fix for this polymorphic deserialization gadget vulnerability (blacklisting net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in SubTypeValidator) was already present in the upstream jackson-databind 2.18.5 release when TuxCare onboarded it. The blacklist entry preventing exploitation appears at SubTypeValidator.java:99. Fix commit 191a4cdf87 by upstream maintainer tatu.saloranta@iki.fi predates TuxCare's onboarding commit, confirming this is an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:51:16.476690+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target is version 2.18.5-tuxcare.3, which contains the upstream fix blocking deserialization of apache-log4j-extra gadget classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource). The fix was authored by upstream maintainer Tatu Saloranta on October 12, 2019 (commit b5a304a985) and was already present in upstream release 2.18.5 when TuxCare onboarded it on July 13, 2026. The vulnerable pattern (unrestricted deserialization of JNDI gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind versions prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. The target is version 2.18.5-tuxcare.3, which contains the upstream fix blocking deserialization of apache-log4j-extra gadget classes (org.apache.log4j.receivers.db.JNDIConnectionSource and DriverManagerConnectionSource). The fix was authored by upstream maintainer Tatu Saloranta on October 12, 2019 (commit b5a304a985) and was already present in upstream release 2.18.5 when TuxCare onboarded it on July 13, 2026. The vulnerable pattern (unrestricted deserialization of JNDI gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability required blocking deserialization of two ehcache JNDI selector classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that could enable RCE via JNDI injection. The fix was already present in the upstream version 2.18.5 that TuxCare onboarded, as confirmed by the presence of these classes in the SubTypeValidator blocklist (lines 133-135). The fix commit (fc4214a883) was authored by upstream maintainer Tatu Saloranta and was already an ancestor of the first TuxCare commit in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability required blocking deserialization of two ehcache JNDI selector classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) that could enable RCE via JNDI injection. The fix was already present in the upstream version 2.18.5 that TuxCare onboarded, as confirmed by the presence of these classes in the SubTypeValidator blocklist (lines 133-135). The fix commit (fc4214a883) was authored by upstream maintainer Tatu Saloranta and was already an ancestor of the first TuxCare commit in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:06.581572+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.18.5) is not affected by CVE-2020-10650. The vulnerability concerns unsafe deserialization of dangerous JNDI gadget classes (ignite-jta and quartz-core). The upstream fix (commit a424c038ba by Tatu Saloranta) added these classes to the deserialization blocklist in SubTypeValidator.java and was already included in the upstream version 2.18.5 that TuxCare onboarded. The blocklist enforcement is verified and active in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind version 2.18.5) is not affected by CVE-2020-10650. The vulnerability concerns unsafe deserialization of dangerous JNDI gadget classes (ignite-jta and quartz-core). The upstream fix (commit a424c038ba by Tatu Saloranta) added these classes to the deserialization blocklist in SubTypeValidator.java and was already included in the upstream version 2.18.5 that TuxCare onboarded. The blocklist enforcement is verified and active in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target is version 2.18.5-tuxcare.3, which already contains the upstream fix that blocks deserialization of the org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory gadget class. The fix was applied by upstream author Tatu Saloranta in commit 592872f4 on March 15, 2020, and was first released in version 2.9.10.4. TuxCare onboarded version 2.18.5 in July 2026, which already included this fix. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target is version 2.18.5-tuxcare.3, which already contains the upstream fix that blocks deserialization of the org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory gadget class. The fix was applied by upstream author Tatu Saloranta in commit 592872f4 on March 15, 2020, and was first released in version 2.9.10.4. TuxCare onboarded version 2.18.5 in July 2026, which already included this fix. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 does not affect jackson-databind 2.18.5-tuxcare.3. The vulnerability involves deserialization of the gadget class com.caucho.config.types.ResourceRef via polymorphic typing. The fix (adding this class to the blocklist in SubTypeValidator.java) was included in upstream version 2.18.5 before TuxCare onboarded it. The blocklist entry exists at line 167 and is actively enforced during deserialization via validateSubType() called from BeanDeserializerFactory line 1103. When the blocked class is encountered, deserialization fails with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 does not affect jackson-databind 2.18.5-tuxcare.3. The vulnerability involves deserialization of the gadget class com.caucho.config.types.ResourceRef via polymorphic typing. The fix (adding this class to the blocklist in SubTypeValidator.java) was included in upstream version 2.18.5 before TuxCare onboarded it. The blocklist entry exists at line 167 and is actively enforced during deserialization via validateSubType() called from BeanDeserializerFactory line 1103. When the blocked class is encountered, deserialization fails with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 targets jackson-databind versions before 2.9.10.4, concerning deserialization gadgets org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.18.5-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream jackson-databind 2.18.5 release that TuxCare onboarded. The blacklist entries blocking these gadget classes exist at SubTypeValidator.java lines 170-171 and are actively enforced during deserialization via BeanDeserializerFactory. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta on March 25, 2020, and predates TuxCare's onboarding of this version on July 13, 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 targets jackson-databind versions before 2.9.10.4, concerning deserialization gadgets org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.18.5-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream jackson-databind 2.18.5 release that TuxCare onboarded. The blacklist entries blocking these gadget classes exist at SubTypeValidator.java lines 170-171 and are actively enforced during deserialization via BeanDeserializerFactory. The fix commit (05d7e0e13f) was authored by upstream maintainer Tatu Saloranta on March 25, 2020, and predates TuxCare's onboarding of this version on July 13, 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves the deserialization of javax.swing.JEditorPane as a serialization gadget when polymorphic type handling is enabled. The upstream vendor (FasterXML) fixed this by adding javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.5 release that TuxCare onboarded, as evidenced by commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 (authored by tatu.saloranta@iki.fi) being an ancestor of the first TuxCare commit 66469eba02491a36997affe2dfec69f41ef9f61c. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves the deserialization of javax.swing.JEditorPane as a serialization gadget when polymorphic type handling is enabled. The upstream vendor (FasterXML) fixed this by adding javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.18.5 release that TuxCare onboarded, as evidenced by commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 (authored by tatu.saloranta@iki.fi) being an ancestor of the first TuxCare commit 66469eba02491a36997affe2dfec69f41ef9f61c. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing attackers to specify dangerous org.apache.activemq.* classes via type metadata, enabling code execution. The upstream vendor (FasterXML) fixed this in commits c14c9f99ed and 05d7e0e13f by adding all nine activemq classes to the SubTypeValidator blocklist. These upstream fixes were already included in the jackson-databind 2.18.5 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing attackers to specify dangerous org.apache.activemq.* classes via type metadata, enabling code execution. The upstream vendor (FasterXML) fixed this in commits c14c9f99ed and 05d7e0e13f by adding all nine activemq classes to the SubTypeValidator blocklist. These upstream fixes were already included in the jackson-databind 2.18.5 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.5-tuxcare.3) is NOT affected by CVE-2020-11112. The upstream fix commit 05d7e0e13f, which adds the blocklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider to SubTypeValidator, was already present in the upstream release 2.18.5 that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target code. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare, and shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.5-tuxcare.3) is NOT affected by CVE-2020-11112. The upstream fix commit 05d7e0e13f, which adds the blocklist entry for org.apache.commons.proxy.provider.remoting.RmiProvider to SubTypeValidator, was already present in the upstream release 2.18.5 that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target code. The fix was authored by upstream maintainer Tatu Saloranta, not by TuxCare, and shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind 2.18.5. The vulnerability involves deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was included in the upstream release 2.18.5 by upstream maintainer Tatu Saloranta before TuxCare onboarded the version. The blacklist entry is present at line 84 of SubTypeValidator.java and is actively enforced by the validateSubType() method during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is not present in jackson-databind 2.18.5. The vulnerability involves deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was included in the upstream release 2.18.5 by upstream maintainer Tatu Saloranta before TuxCare onboarded the version. The blacklist entry is present at line 84 of SubTypeValidator.java and is actively enforced by the validateSubType() method during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The fix (blocking deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) was already present in upstream release 2.18.5 before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) does not exist in the target. The fix commit 113e89fb08 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (66469eba02 \"Onboard version 2.18.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target jackson-databind 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The fix (blocking deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) was already present in upstream release 2.18.5 before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) does not exist in the target. The fix commit 113e89fb08 was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (66469eba02 \"Onboard version 2.18.5\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves a deserialization gadget (org.apache.commons.jelly.impl.Embedded) that could enable remote code execution. The upstream vendor (FasterXML) fixed this in commit 77040d85e3 by adding the gadget class to SubTypeValidator's blocklist. This fix was already present in upstream version 2.18.5, which TuxCare onboarded. The vulnerable pattern does not exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves a deserialization gadget (org.apache.commons.jelly.impl.Embedded) that could enable remote code execution. The upstream vendor (FasterXML) fixed this in commit 77040d85e3 by adding the gadget class to SubTypeValidator's blocklist. This fix was already present in upstream version 2.18.5, which TuxCare onboarded. The vulnerable pattern does not exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5 is not affected by CVE-2020-14060. The upstream fix for this deserialization gadget vulnerability is present in the codebase. The blocklist entries for the dangerous classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool, oadd.org.apache.commons.dbcp.datasources.PerUserPoolDataSource, oadd.org.apache.commons.dbcp.datasources.SharedPoolDataSource) are included in SubTypeValidator.java at lines 192-195, and the validation mechanism actively blocks deserialization of these classes. This fix was authored by upstream FasterXML maintainer Tatu Saloranta and shipped in the upstream 2.18.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "The target jackson-databind 2.18.5 is not affected by CVE-2020-14060. The upstream fix for this deserialization gadget vulnerability is present in the codebase. The blocklist entries for the dangerous classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool, oadd.org.apache.commons.dbcp.datasources.PerUserPoolDataSource, oadd.org.apache.commons.dbcp.datasources.SharedPoolDataSource) are included in SubTypeValidator.java at lines 192-195, and the validation mechanism actively blocks deserialization of these classes. This fix was authored by upstream FasterXML maintainer Tatu Saloranta and shipped in the upstream 2.18.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 does not affect jackson-databind 2.18.5 because the upstream fix was already included in the 2.18.5 release. The five Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are already blocked in SubTypeValidator.java at lines 200-204. This fix was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae9 (2020-04-24), which predates TuxCare's onboarding of version 2.18.5 in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 does not affect jackson-databind 2.18.5 because the upstream fix was already included in the 2.18.5 release. The five Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are already blocked in SubTypeValidator.java at lines 200-204. This fix was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae9 (2020-04-24), which predates TuxCare's onboarding of version 2.18.5 in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5 is NOT affected by CVE-2020-14062. The dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is already blocked in the SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES set (line 119). The fix was introduced in upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta and was already present in the upstream 2.18.5 release when TuxCare onboarded it (first TuxCare commit: 66469eba02). Since the fix came from upstream (author: tatu.saloranta@iki.fi, not a TuxCare/CloudLinux domain), this is classified as not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "The target jackson-databind 2.18.5 is NOT affected by CVE-2020-14062. The dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is already blocked in the SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES set (line 119). The fix was introduced in upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta and was already present in the upstream 2.18.5 release when TuxCare onboarded it (first TuxCare commit: 66469eba02). Since the fix came from upstream (author: tatu.saloranta@iki.fi, not a TuxCare/CloudLinux domain), this is classified as not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory. The target (jackson-databind 2.18.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the 2.18.5 release that TuxCare onboarded. The gadget class is properly blocklisted at SubTypeValidator.java:207, preventing deserialization-based JNDI injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory. The target (jackson-databind 2.18.5-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the 2.18.5 release that TuxCare onboarded. The gadget class is properly blocklisted at SubTypeValidator.java:207, preventing deserialization-based JNDI injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:45.297248+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The upstream fix (commit 3d97153944, dated 2020-08-10) added this class to SubTypeValidator's blocklist, preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.9.10.6. Since 2.18.5 is much newer (released 2025+), it includes this fix in its upstream release. The fix was present before TuxCare's onboarding commit (66469eba02, dated 2026-07-13) and remains in the current HEAD at line 147 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPDataSource gadget class. The upstream fix (commit 3d97153944, dated 2020-08-10) added this class to SubTypeValidator's blocklist, preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream release 2.9.10.6. Since 2.18.5 is much newer (released 2025+), it includes this fix in its upstream release. The fix was present before TuxCare's onboarding commit (66469eba02, dated 2026-07-13) and remains in the current HEAD at line 147 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:18:09.376674+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT PRESENT in jackson-databind 2.18.5. The vulnerability relates to deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration enabling JNDI injection attacks. The upstream vendor (FasterXML) added this class to the SubTypeValidator blocklist in commit 6cc9f1a1af (July 2020), which was already included in the upstream 2.18.5 release that TuxCare onboarded. The defense is present at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:210 and is actively enforced during bean deserialization. The target version (2.18.5) is much newer than the affected versions (< 2.6.7.5 and 2.7.x < 2.9.10.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT PRESENT in jackson-databind 2.18.5. The vulnerability relates to deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration enabling JNDI injection attacks. The upstream vendor (FasterXML) added this class to the SubTypeValidator blocklist in commit 6cc9f1a1af (July 2020), which was already included in the upstream 2.18.5 release that TuxCare onboarded. The defense is present at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:210 and is actively enforced during bean deserialization. The target version (2.18.5) is much newer than the affected versions (< 2.6.7.5 and 2.7.x < 2.9.10.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in target version 2.18.5. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits 612f971b78 and 3d932709ab, which added two XML parser security features to prevent XXE attacks: (1) disallow-doctype-decl=true and (2) load-external-dtd=false. These commits shipped in the upstream 2.18.5 release that TuxCare onboarded (first TuxCare commit: 66469eba02 \"Onboard version 2.18.5\" by evasilev@cloudlinux.com). The fix is present and active in DOMDeserializer.java lines 40-46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in target version 2.18.5. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commits 612f971b78 and 3d932709ab, which added two XML parser security features to prevent XXE attacks: (1) disallow-doctype-decl=true and (2) load-external-dtd=false. These commits shipped in the upstream 2.18.5 release that TuxCare onboarded (first TuxCare commit: 66469eba02 \"Onboard version 2.18.5\" by evasilev@cloudlinux.com). The fix is present and active in DOMDeserializer.java lines 40-46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:23:14.032161+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8. The target repository is jackson-databind version 2.18.5-tuxcare.3, which already contains the upstream fix. The vulnerability involved deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix adds these classes to jackson-databind's SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their deserialization. This fix was authored by the upstream maintainer (Tatu Saloranta) in commit 41b8bdb5cc and was already present in upstream version 2.18.5 when TuxCare onboarded it. The target is not affected because the vulnerable code pattern is not present - the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8. The target repository is jackson-databind version 2.18.5-tuxcare.3, which already contains the upstream fix. The vulnerability involved deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The fix adds these classes to jackson-databind's SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their deserialization. This fix was authored by the upstream maintainer (Tatu Saloranta) in commit 41b8bdb5cc and was already present in upstream version 2.18.5 when TuxCare onboarded it. The target is not affected because the vulnerable code pattern is not present - the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:09.053481+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 by allowing deserialization of dangerous Apache Commons DBCP2 classes (SharedPoolDataSource, PerUserPoolDataSource). The target version 2.18.5-tuxcare.3 is NOT affected because the upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, Dec 15, 2020) was already present in upstream 2.18.5 when TuxCare onboarded it. The fix adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 217-218, preventing their deserialization with the error message \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 by allowing deserialization of dangerous Apache Commons DBCP2 classes (SharedPoolDataSource, PerUserPoolDataSource). The target version 2.18.5-tuxcare.3 is NOT affected because the upstream fix (commit 41b8bdb5ccc by Tatu Saloranta, Dec 15, 2020) was already present in upstream 2.18.5 when TuxCare onboarded it. The fix adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 217-218, preventing their deserialization with the error message \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:55:46.062749+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a missing blacklist entry for the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.18.5-tuxcare.3 contains the upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by tatu.saloranta@iki.fi) that adds this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist (line 240). This fix shipped in the upstream 2.18.5 release before TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a missing blacklist entry for the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.18.5-tuxcare.3 contains the upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by tatu.saloranta@iki.fi) that adds this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist (line 240). This fix shipped in the upstream 2.18.5 release before TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.18.5. The vulnerability involves deserialization of the DriverAdapterCPDS gadget class variants. The fix (blocklisting all five DriverAdapterCPDS variants) was applied in upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta on 2020-12-31, and this fix was already included in the upstream release 2.18.5 that TuxCare onboarded in July 2026. All five gadget class names are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.18.5. The vulnerability involves deserialization of the DriverAdapterCPDS gadget class variants. The fix (blocklisting all five DriverAdapterCPDS variants) was applied in upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta on 2020-12-31, and this fix was already included in the upstream release 2.18.5 that TuxCare onboarded in July 2026. All five gadget class names are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:42:13.542842+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36180. The vulnerability, which involves deserialization of the org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS gadget class, has been mitigated by an upstream fix that was already present in the base 2.18.5 release. The fix (commit 3ded28aece, authored by upstream maintainer Tatu Saloranta on Dec 31, 2020) adds DriverAdapterCPDS and related DBCP variants to Jackson's SubTypeValidator blocklist, preventing their deserialization. This fix shipped in the upstream release before TuxCare onboarding, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target repository jackson-databind version 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36180. The vulnerability, which involves deserialization of the org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS gadget class, has been mitigated by an upstream fix that was already present in the base 2.18.5 release. The fix (commit 3ded28aece, authored by upstream maintainer Tatu Saloranta on Dec 31, 2020) adds DriverAdapterCPDS and related DBCP variants to Jackson's SubTypeValidator blocklist, preventing their deserialization. This fix shipped in the upstream release before TuxCare onboarding, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:45:42.706698+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-36181. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS (and related variants) which could enable JNDI injection attacks. The fix, which blacklists these dangerous classes in SubTypeValidator.java, was applied by upstream maintainer Tatu Saloranta in commit 3ded28aece6 and shipped in the upstream release 2.18.5 that TuxCare onboarded. All five DriverAdapterCPDS variants from the patch are present in the current blacklist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target repository jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-36181. The vulnerability involves deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS (and related variants) which could enable JNDI injection attacks. The fix, which blacklists these dangerous classes in SubTypeValidator.java, was applied by upstream maintainer Tatu Saloranta in commit 3ded28aece6 and shipped in the upstream release 2.18.5 that TuxCare onboarded. All five DriverAdapterCPDS variants from the patch are present in the current blacklist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:13:47.994162+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-36182. The vulnerability involves Jackson's polymorphic deserialization of dangerous DriverAdapterCPDS gadget classes that can enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding all DriverAdapterCPDS class variants to SubTypeValidator's blacklist. This fix was already present in upstream version 2.18.5 when TuxCare onboarded it (first TuxCare commit 66469eba). All four DriverAdapterCPDS variants are now blocked: org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, and org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS (the CVE-specific class).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "Target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-36182. The vulnerability involves Jackson's polymorphic deserialization of dangerous DriverAdapterCPDS gadget classes that can enable arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding all DriverAdapterCPDS class variants to SubTypeValidator's blacklist. This fix was already present in upstream version 2.18.5 when TuxCare onboarded it (first TuxCare commit 66469eba). All four DriverAdapterCPDS variants are now blocked: org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, and org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS (the CVE-specific class).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:22:16.875749+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36183. The vulnerable gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked by the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java:243. This fix was authored by upstream maintainer Tatu Saloranta (commit 12e23c962ff, 2020-12-31) and was already present in the upstream 2.18.5 release before TuxCare's onboarding. The blacklist is actively enforced during polymorphic deserialization validation (SubTypeValidator.java:269), preventing exploitation of this JNDI injection gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "Target jackson-databind 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2020-36183. The vulnerable gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool is blocked by the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java:243. This fix was authored by upstream maintainer Tatu Saloranta (commit 12e23c962ff, 2020-12-31) and was already present in the upstream 2.18.5 release before TuxCare's onboarding. The blacklist is actively enforced during polymorphic deserialization validation (SubTypeValidator.java:269), preventing exploitation of this JNDI injection gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:36:33.098195+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for dangerous Tomcat DBCP2 datasource classes. The target repository (jackson-databind 2.18.5-tuxcare.3) is not vulnerable because the fix was already present in the upstream 2.18.5 release. The dangerous classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource are properly blocklisted in SubTypeValidator.java (lines 235-236), preventing their deserialization and blocking the attack chain from malicious JSON input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for dangerous Tomcat DBCP2 datasource classes. The target repository (jackson-databind 2.18.5-tuxcare.3) is not vulnerable because the fix was already present in the upstream 2.18.5 release. The dangerous classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource are properly blocklisted in SubTypeValidator.java (lines 235-236), preventing their deserialization and blocking the attack chain from malicious JSON input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind 2.x before 2.9.10.8, related to deserialization gadgets involving org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target version 2.18.5-tuxcare.3 is not affected because the upstream fix (commit 567194c53a by Tatu Saloranta, Dec 26 2020) was already present in the upstream 2.18.5 release before TuxCare onboarding. The fix adds the vulnerable classes to the deserialization blocklist in SubTypeValidator.java (lines 234-236), preventing their instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind 2.x before 2.9.10.8, related to deserialization gadgets involving org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. The target version 2.18.5-tuxcare.3 is not affected because the upstream fix (commit 567194c53a by Tatu Saloranta, Dec 26 2020) was already present in the upstream 2.18.5 release before TuxCare onboarding. The fix adds the vulnerable classes to the deserialization blocklist in SubTypeValidator.java (lines 234-236), preventing their instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:38:50.686696+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability concerns deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) that can lead to arbitrary code execution. The fix blocking these classes was already present in upstream version 2.18.5 when TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java lines 229-230, added by upstream commit 3e8fa3beea authored by Tatu Saloranta on Dec 26, 2020. Since the target version (2.18.5) is much newer than the CVE's affected range (before 2.9.10.8), the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability concerns deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) that can lead to arbitrary code execution. The fix blocking these classes was already present in upstream version 2.18.5 when TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java lines 229-230, added by upstream commit 3e8fa3beea authored by Tatu Saloranta on Dec 26, 2020. Since the target version (2.18.5) is much newer than the CVE's affected range (before 2.9.10.8), the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:46.568438+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 does not affect jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and related classes. The fix (blocklist entries) was already present in upstream release 2.18.5, committed by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3e8fa3beea on Dec 26, 2020. TuxCare onboarded version 2.18.5 with this fix already included. The vulnerable pattern (missing blocklist entries) never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 does not affect jackson-databind 2.18.5-tuxcare.3. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and related classes. The fix (blocklist entries) was already present in upstream release 2.18.5, committed by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3e8fa3beea on Dec 26, 2020. TuxCare onboarded version 2.18.5 with this fix already included. The vulnerable pattern (missing blocklist entries) never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes. The fix was already included in the upstream 2.18.5 release that TuxCare onboarded. Both dangerous classes are present in the deserialization blocklist at SubTypeValidator.java:223-224, preventing exploitation of this deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource classes. The fix was already included in the upstream 2.18.5 release that TuxCare onboarded. Both dangerous classes are present in the deserialization blocklist at SubTypeValidator.java:223-224, preventing exploitation of this deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:13.759745+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 does not affect jackson-databind 2.18.5. The vulnerability involves deserialization of dangerous gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource). The upstream fix, which adds these classes to the SubTypeValidator blacklist, was committed by Tatu Saloranta on 2020-12-26 (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4) and was already present in upstream version 2.18.5 when TuxCare onboarded it on 2026-07-13. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 does not affect jackson-databind 2.18.5. The vulnerability involves deserialization of dangerous gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource). The upstream fix, which adds these classes to the SubTypeValidator blacklist, was committed by Tatu Saloranta on 2020-12-26 (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4) and was already present in upstream version 2.18.5 when TuxCare onboarded it on 2026-07-13. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:47.001354+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. jackson-databind 2.18.5-tuxcare.3 is not vulnerable to CVE-2020-36518. The upstream re-implementation in commit 8238ab41d0 (May 2022) replaced the recursive Vanilla deserializer with UntypedObjectDeserializerNR, which uses an iterative algorithm (lines 212-320, `_deserializeNR` with while-loops and heap-based scope tracking) that cannot cause stack overflow regardless of nesting depth. The deprecated Vanilla class (which originally had the vulnerability and later received the MAX_DEPTH=1000 fix in fcfc4998ec) is unreachable in production - line 199 always returns UntypedObjectDeserializerNR.instance(). Test file DeepNestingUntypedDeserTest.java confirms the NR implementation handles 100k+ nesting levels without stack overflow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "jackson-databind 2.18.5-tuxcare.3 is not vulnerable to CVE-2020-36518. The upstream re-implementation in commit 8238ab41d0 (May 2022) replaced the recursive Vanilla deserializer with UntypedObjectDeserializerNR, which uses an iterative algorithm (lines 212-320, `_deserializeNR` with while-loops and heap-based scope tracking) that cannot cause stack overflow regardless of nesting depth. The deprecated Vanilla class (which originally had the vulnerability and later received the MAX_DEPTH=1000 fix in fcfc4998ec) is unreachable in production - line 199 always returns UntypedObjectDeserializerNR.instance(). Test file DeepNestingUntypedDeserTest.java confirms the NR implementation handles 100k+ nesting levels without stack overflow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:15:35.096684+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-8840. The upstream fix that blocks deserialization of org.apache.xbean.propertyeditor.JndiConverter was already present in the upstream 2.18.5 release that TuxCare onboarded. The fix (commit 914e7c9f2c by upstream maintainer Tatu Saloranta) adds JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing JNDI injection attacks via polymorphic deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind 2.18.5-tuxcare.3 is not affected by CVE-2020-8840. The upstream fix that blocks deserialization of org.apache.xbean.propertyeditor.JndiConverter was already present in the upstream 2.18.5 release that TuxCare onboarded. The fix (commit 914e7c9f2c by upstream maintainer Tatu Saloranta) adds JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing JNDI injection attacks via polymorphic deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.5-tuxcare.3 is NOT affected by CVE-2020-9546. The vulnerability involves deserialization gadget chains using org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to achieve arbitrary code execution. The upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta) added HikariConfig to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.18.5 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of the first TuxCare commit (66469eba0 \"Onboard version 2.18.5\"). The blocklist check is active by default and enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target jackson-databind 2.18.5-tuxcare.3 is NOT affected by CVE-2020-9546. The vulnerability involves deserialization gadget chains using org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to achieve arbitrary code execution. The upstream vendor fix (commit 1e64db6a2f by Tatu Saloranta) added HikariConfig to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream 2.18.5 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of the first TuxCare commit (66469eba0 \"Onboard version 2.18.5\"). The blocklist check is active by default and enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:46:24.540154+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves deserialization of the ibatis-sqlmap gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream version 2.18.5 before TuxCare onboarding. The blocklist entry exists at SubTypeValidator.java:144 and is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.18.5-tuxcare.3. The vulnerability involves deserialization of the ibatis-sqlmap gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix (adding this class to the SubTypeValidator blocklist) was already present in upstream version 2.18.5 before TuxCare onboarding. The blocklist entry exists at SubTypeValidator.java:144 and is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:20:17.888209+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7. The target version 2.18.5 already contains the upstream fix that adds br.com.anteros.dbcp.AnterosDBCPConfig to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta in February 2020 (commit 9f4e97019fb) and was present in the upstream 2.18.5 release before TuxCare onboarded it. The vulnerable pattern (missing blocklist entry) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7. The target version 2.18.5 already contains the upstream fix that adds br.com.anteros.dbcp.AnterosDBCPConfig to the SubTypeValidator blocklist. This fix was authored by upstream maintainer Tatu Saloranta in February 2020 (commit 9f4e97019fb) and was present in the upstream 2.18.5 release before TuxCare onboarded it. The vulnerable pattern (missing blocklist entry) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:17:20.138118+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind versions before 2.9.10.7. The target version 2.18.5 already contains the upstream fix that blocks deserialization of javax.swing.JTextPane and other gadget classes via SubTypeValidator. The fix was applied in upstream commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream maintainer Tatu Saloranta in September 2020, well before version 2.18.5 was released in December 2024. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 affects jackson-databind versions before 2.9.10.7. The target version 2.18.5 already contains the upstream fix that blocks deserialization of javax.swing.JTextPane and other gadget classes via SubTypeValidator. The fix was applied in upstream commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream maintainer Tatu Saloranta in September 2020, well before version 2.18.5 was released in December 2024. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The target version 2.18.5 already contains the upstream fix (commit 3ccde7d938) that was authored by Tatu Saloranta and shipped in the upstream 2.18.5 release. The fix adds a 100KB allocation limit (LONGEST_EAGER_ALLOC) and implements chunked reading via ByteArrayBuilder for larger content, preventing the DoS vulnerability where malicious JDK-serialized JsonNode objects could claim 2GB+ lengths and cause immediate heap exhaustion. The vulnerable code pattern (direct allocation based on untrusted length) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 affects jackson-databind versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The target version 2.18.5 already contains the upstream fix (commit 3ccde7d938) that was authored by Tatu Saloranta and shipped in the upstream 2.18.5 release. The fix adds a 100KB allocation limit (LONGEST_EAGER_ALLOC) and implements chunked reading via ByteArrayBuilder for larger content, preventing the DoS vulnerability where malicious JDK-serialized JsonNode objects could claim 2GB+ lengths and cause immediate heap exhaustion. The vulnerable code pattern (direct allocation based on untrusted length) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2022-42003. The vulnerability (resource exhaustion via deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in the upstream codebase before TuxCare onboarded version 2.18.5. The fix adds checks throughout the deserialization layer to detect and reject nested START_ARRAY tokens, preventing unbounded recursive processing. Fix commit 2c4a601c62 from upstream developer Richard Zowalla was already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "Target jackson-databind 2.18.5-tuxcare.3 is NOT AFFECTED by CVE-2022-42003. The vulnerability (resource exhaustion via deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in the upstream codebase before TuxCare onboarded version 2.18.5. The fix adds checks throughout the deserialization layer to detect and reject nested START_ARRAY tokens, preventing unbounded recursive processing. Fix commit 2c4a601c62 from upstream developer Richard Zowalla was already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:48.956683+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 describes a resource exhaustion vulnerability in jackson-databind due to deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.18.5-tuxcare.3 is NOT AFFECTED because the fix for this vulnerability was already present in the upstream release 2.18.5 that TuxCare onboarded. The fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was shipped in the upstream release and adds a check in BeanDeserializer._deserializeFromArray() to reject consecutive START_ARRAY tokens, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 describes a resource exhaustion vulnerability in jackson-databind due to deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.18.5-tuxcare.3 is NOT AFFECTED because the fix for this vulnerability was already present in the upstream release 2.18.5 that TuxCare onboarded. The fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was shipped in the upstream release and adds a check in BeanDeserializer._deserializeFromArray() to reject consecutive START_ARRAY tokens, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T20:23:00.112323+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 (DoS via deeply nested JSON causing stack overflow during JsonNode.toString() serialization) is NOT present in jackson-databind 2.18.5-tuxcare.3. The upstream fix (commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by Tatu Saloranta, released in upstream 2.14.0) was already included in the 2.18.5 base release that TuxCare onboarded. The vulnerable recursive serialization pattern has...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 (DoS via deeply nested JSON causing stack overflow during JsonNode.toString() serialization) is NOT present in jackson-databind 2.18.5-tuxcare.3. The upstream fix (commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by Tatu Saloranta, released in upstream 2.14.0) was already included in the 2.18.5 base release that TuxCare onboarded. The vulnerable recursive serialization pattern has..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:17:33.879237+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the renamed JSON key cannot reach the backing field when its setter is ignored. src/main/java/com/fasterxml/jackson/databind/introspect/POJOPropertiesCollector.java:1385 skips ignored names before applying explicit renames. src/main/java/com/fasterxml/jackson/databind/introspect/POJOPropertyBuilder.java:154 returns the stored property name, so the getter\u2019s renamed key has no matching field property.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the renamed JSON key cannot reach the backing field when its setter is ignored. src/main/java/com/fasterxml/jackson/databind/introspect/POJOPropertiesCollector.java:1385 skips ignored names before applying explicit renames. src/main/java/com/fasterxml/jackson/databind/introspect/POJOPropertyBuilder.java:154 returns the stored property name, so the getter\u2019s renamed key has no matching field property."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:17:33.879237+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it rejects unwrapped creator parameters, preventing the vulnerable input path. Unnamed parameters are rejected in src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:540, and named parameters are rejected in src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020. Supported unwrapped replay checks active-view visibility before setting properties in src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java:61.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it rejects unwrapped creator parameters, preventing the vulnerable input path. Unnamed parameters are rejected in src/main/java/com/fasterxml/jackson/databind/deser/BasicDeserializerFactory.java:540, and named parameters are rejected in src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java:1020. Supported unwrapped replay checks active-view visibility before setting properties in src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java:61."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.18.5-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:35.345762+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.18.5-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}