{
  "@id": "urn:uuid:08af0dde-3e97-49e4-9166-48b88a4d22fb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 86,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:28:05.466388+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.8-tuxcare.2 is NOT affected by CVE-2017-15095. The vulnerability was fixed in upstream jackson-databind versions 2.8.11 and 2.9.4, and the target version (2.18.8) is significantly newer. The fix introduces a blacklist mechanism in SubTypeValidator that blocks dangerous classes from polymorphic deserialization. The blacklist includes all classes from CVE-2017-15095: com.sun.rowset.JdbcRowSetImpl (issue #1680), java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 3rd party classes (issue #1737). The fix was authored by the upstream vendor (Tatu Saloranta) and was already present in the upstream release 2.18.8 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "Target version 2.18.8-tuxcare.2 is NOT affected by CVE-2017-15095. The vulnerability was fixed in upstream jackson-databind versions 2.8.11 and 2.9.4, and the target version (2.18.8) is significantly newer. The fix introduces a blacklist mechanism in SubTypeValidator that blocks dangerous classes from polymorphic deserialization. The blacklist includes all classes from CVE-2017-15095: com.sun.rowset.JdbcRowSetImpl (issue #1680), java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 3rd party classes (issue #1737). The fix was authored by the upstream vendor (Tatu Saloranta) and was already present in the upstream release 2.18.8 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2017-17485. The upstream fix (SubTypeValidator with comprehensive blacklist for Spring/C3P0/JDK gadget classes) was already present in version 2.18.8 before TuxCare onboarded it. Fix committed 2017-12-18 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 2235894210c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target jackson-databind 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2017-17485. The upstream fix (SubTypeValidator with comprehensive blacklist for Spring/C3P0/JDK gadget classes) was already present in version 2.18.8 before TuxCare onboarded it. Fix committed 2017-12-18 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 2235894210c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:37:15.372164+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.18.8. The vulnerability involved unsafe deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.) enabling arbitrary code execution. The upstream project fixed this in version 2.8.11 (Dec 2017) by introducing SubTypeValidator with a blacklist of dangerous classes. Version 2.18.8, released much later, inherits this upstream fix. The defense mechanism validates types before deserialization and rejects all classes from the CVE-2017-7525 attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.18.8. The vulnerability involved unsafe deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.) enabling arbitrary code execution. The upstream project fixed this in version 2.8.11 (Dec 2017) by introducing SubTypeValidator with a blacklist of dangerous classes. Version 2.18.8, released much later, inherits this upstream fix. The defense mechanism validates types before deserialization and rejects all classes from the CVE-2017-7525 attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:24:51.671524+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.18.8. The vulnerability involved Jackson default typing with the iBatis XPathParser gadget class allowing data exfiltration via XXE. The upstream vendor fix (adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist) was already present in upstream release 2.18.8 before TuxCare onboarded this version. The fix is found in SubTypeValidator.java at line 65, preventing deserialization of the malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.18.8. The vulnerability involved Jackson default typing with the iBatis XPathParser gadget class allowing data exfiltration via XXE. The upstream vendor fix (adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist) was already present in upstream release 2.18.8 before TuxCare onboarded this version. The fix is found in SubTypeValidator.java at line 65, preventing deserialization of the malicious gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows polymorphic deserialization gadget attacks via Jodd-db and Oracle JDBC classes when Default Typing is enabled, leading to remote code execution via attacker-controlled LDAP servers. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED because the upstream vendor's fix was already present in version 2.18.8, which TuxCare onboarded. The fix adds three class names to the deserialization blacklist in SubTypeValidator.java (lines 67-72), preventing instantiation of the vulnerable gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows polymorphic deserialization gadget attacks via Jodd-db and Oracle JDBC classes when Default Typing is enabled, leading to remote code execution via attacker-controlled LDAP servers. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED because the upstream vendor's fix was already present in version 2.18.8, which TuxCare onboarded. The fix adds three class names to the deserialization blacklist in SubTypeValidator.java (lines 67-72), preventing instantiation of the vulnerable gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.18.8-tuxcare.3. This vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, involving polymorphic deserialization of Oracle JDBC driver classes that enable JNDI/LDAP injection attacks. The target version 2.18.8 already contains the upstream fix that blacklists the dangerous Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. This fix was shipped in the upstream release 2.18.8 that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.18.8-tuxcare.3. This vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, involving polymorphic deserialization of Oracle JDBC driver classes that enable JNDI/LDAP injection attacks. The target version 2.18.8 already contains the upstream fix that blacklists the dangerous Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. This fix was shipped in the upstream release 2.18.8 that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:03:22.406684+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.18.8-tuxcare.3. The target contains the upstream fix that blocks org.slf4j.ext.EventData and other dangerous classes from polymorphic deserialization. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.18.8-tuxcare.3. The target contains the upstream fix that blocks org.slf4j.ext.EventData and other dangerous classes from polymorphic deserialization. The fix (commit 87d29af25e) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of blaze-ds classes that could lead to arbitrary code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) was applied in August 2018 and blocks dangerous classes including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (from blaze-ds) via a deny-list in SubTypeValidator. This fix was already present in the upstream 2.18.8 release when TuxCare onboarded it in commit 456e6e12, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of blaze-ds classes that could lead to arbitrary code execution. The upstream fix (commit 87d29af25e by Tatu Saloranta) was applied in August 2018 and blocks dangerous classes including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (from blaze-ds) via a deny-list in SubTypeValidator. This fix was already present in the upstream 2.18.8 release when TuxCare onboarded it in commit 456e6e12, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:11:33.363226+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 affects jackson-databind versions before 2.9.7 where polymorphic deserialization fails to block four specific dangerous classes (EventData, AsynchBeansWorkManagerExecutor, DRSHelper, HandlerResolverImpl) that enable arbitrary code execution. The target repository (jackson-databind 2.18.8-tuxcare.3) already contains the fix in SubTypeValidator.java:75-78 where all four classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in upstream release 2.18.8, which TuxCare later onboarded. The SubTypeValidator.validateSubType() method is invoked during bean deserialization (BeanDeserializerFactory.java:141) and blocks instantiation of any blacklisted class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 affects jackson-databind versions before 2.9.7 where polymorphic deserialization fails to block four specific dangerous classes (EventData, AsynchBeansWorkManagerExecutor, DRSHelper, HandlerResolverImpl) that enable arbitrary code execution. The target repository (jackson-databind 2.18.8-tuxcare.3) already contains the fix in SubTypeValidator.java:75-78 where all four classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was authored by upstream maintainer Tatu Saloranta in commit 87d29af25e and shipped in upstream release 2.18.8, which TuxCare later onboarded. The SubTypeValidator.validateSubType() method is invoked during bean deserialization (BeanDeserializerFactory.java:141) and blocks instantiation of any blacklisted class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:54.716958+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.18.8 is not affected by CVE-2018-14721. The fix blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already present in the upstream Jackson 2.18.8 release when TuxCare onboarded it. The class is blocked at line 78 of SubTypeValidator.java, added by upstream maintainer Tatu Saloranta in commit 0899726ec34 on 2018-08-16, which predates the TuxCare onboarding by approximately 8 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "Target version 2.18.8 is not affected by CVE-2018-14721. The fix blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already present in the upstream Jackson 2.18.8 release when TuxCare onboarded it. The class is blocked at line 78 of SubTypeValidator.java, added by upstream maintainer Tatu Saloranta in commit 0899726ec34 on 2018-08-16, which predates the TuxCare onboarding by approximately 8 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.18.8-tuxcare.2 is NOT affected by CVE-2018-19360. The vulnerability pattern (missing blacklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo) is not present because the fix was already included in the upstream release that TuxCare onboarded. The fix commit 72cd4025a2 by Tatu Saloranta added the class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java at line 85, preventing polymorphic deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "The target repository jackson-databind 2.18.8-tuxcare.2 is NOT affected by CVE-2018-19360. The vulnerability pattern (missing blacklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo) is not present because the fix was already included in the upstream release that TuxCare onboarded. The fix commit 72cd4025a2 by Tatu Saloranta added the class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java at line 85, preventing polymorphic deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:58.617275+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.18.8-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and JNDIManagedRuntime) that can trigger gadget chain attacks. The fix - adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java - was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (Nov 19, 2018) and shipped in upstream release 2.18.8, which TuxCare onboarded on July 10, 2026. The CVE affects \"2.x before 2.9.8\", and version 2.18.8 is significantly newer (2.18.8 > 2.9.8).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "Target jackson-databind 2.18.8-tuxcare.3 is not affected by CVE-2018-19361. The vulnerability involves polymorphic deserialization of dangerous openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and JNDIManagedRuntime) that can trigger gadget chain attacks. The fix - adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java - was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a2 (Nov 19, 2018) and shipped in upstream release 2.18.8, which TuxCare onboarded on July 10, 2026. The CVE affects \"2.x before 2.9.8\", and version 2.18.8 is significantly newer (2.18.8 > 2.9.8).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8. The target repository is at version 2.18.8-tuxcare.3, which already contains the upstream fix. The vulnerability involved the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) being usable as a deserialization gadget. The fix added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 81), preventing its use in polymorphic deserialization attacks. This fix was authored by upstream maintainer Tatu Saloranta and shipped in version 2.9.8, well before TuxCare onboarded version 2.18.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8. The target repository is at version 2.18.8-tuxcare.3, which already contains the upstream fix. The vulnerability involved the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor) being usable as a deserialization gadget. The fix added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 81), preventing its use in polymorphic deserialization attacks. This fix was authored by upstream maintainer Tatu Saloranta and shipped in version 2.9.8, well before TuxCare onboarded version 2.18.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadget classes. Target version 2.18.8-tuxcare.3 already contains the upstream fix that adds org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist. This fix was part of the upstream 2.18.8 release, applied by FasterXML in January 2018 (commit 038b471e2ef), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadget classes. Target version 2.18.8-tuxcare.3 already contains the upstream fix that adds org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory to the deserialization blacklist. This fix was part of the upstream 2.18.8 release, applied by FasterXML in January 2018 (commit 038b471e2ef), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:12.850766+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes in JSON with polymorphic type information. The upstream vendor (FasterXML) fixed this in commit 6799f8f10c by adding validation logic in SubTypeValidator.java that blocks any class matching pattern \"com.mchange.v2.c3p0.*DataSource\" from being deserialized. This fix was already present in upstream release 2.18.8, which TuxCare subsequently onboarded. The vulnerable code pattern (unrestricted c3p0 deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes in JSON with polymorphic type information. The upstream vendor (FasterXML) fixed this in commit 6799f8f10c by adding validation logic in SubTypeValidator.java that blocks any class matching pattern \"com.mchange.v2.c3p0.*DataSource\" from being deserialized. This fix was already present in upstream release 2.18.8, which TuxCare subsequently onboarded. The vulnerable code pattern (unrestricted c3p0 deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:37:30.400386+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 does not affect jackson-databind 2.18.8-tuxcare.3. The vulnerability required the absence of `com.mysql.cj.jdbc.admin.MiniAdmin` from the polymorphic deserialization blocklist. The target version contains this blocklist entry at SubTypeValidator.java:88, preventing the gadget from being instantiated during JSON deserialization with Default Typing enabled. The fix was introduced in upstream commit dda513bd72 by Tatu Saloranta and was already present in the upstream 2.18.8 release before TuxCare onboarding (first TuxCare commit: 456e6e12ac \"Onboard version 2.18.8\"). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 does not affect jackson-databind 2.18.8-tuxcare.3. The vulnerability required the absence of `com.mysql.cj.jdbc.admin.MiniAdmin` from the polymorphic deserialization blocklist. The target version contains this blocklist entry at SubTypeValidator.java:88, preventing the gadget from being instantiated during JSON deserialization with Default Typing enabled. The fix was introduced in upstream commit dda513bd72 by Tatu Saloranta and was already present in the upstream 2.18.8 release before TuxCare onboarding (first TuxCare commit: 456e6e12ac \"Onboard version 2.18.8\"). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:52:00.183219+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of the logback-core class \"ch.qos.logback.core.db.DriverManagerConnectionSource\". The upstream fix (commit c9ef4a10d6f6633cf470d6a469514b68fa2be234 by Tatu Saloranta, dated 2019-06-12) added this class to the SubTypeValidator blocklist at line 91. This fix was already prese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of the logback-core class \"ch.qos.logback.core.db.DriverManagerConnectionSource\". The upstream fix (commit c9ef4a10d6f6633cf470d6a469514b68fa2be234 by Tatu Saloranta, dated 2019-06-12) added this class to the SubTypeValidator blocklist at line 91. This fix was already prese..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:31:51.997293+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind's polymorphic typing feature, allowing arbitrary file read via JDOM XSLTransformer classes. The target version 2.18.8-tuxcare.3 contains the upstream fix (commit 5f7c69bba0) that adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix shipped in the upstream 2.18.8 r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind's polymorphic typing feature, allowing arbitrary file read via JDOM XSLTransformer classes. The target version 2.18.8-tuxcare.3 contains the upstream fix (commit 5f7c69bba0) that adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix shipped in the upstream 2.18.8 r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.18.8. The vulnerability required the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to be deserializable, allowing remote code execution. The upstream fix (commit ad418eeb97 by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java at line 98. This fix was already present in the upstream release that TuxCare onboarded for version 2.18.8, therefore the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.18.8. The vulnerability required the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to be deserializable, allowing remote code execution. The upstream fix (commit ad418eeb97 by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java at line 98. This fix was already present in the upstream release that TuxCare onboarded for version 2.18.8, therefore the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:47:16.155569+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3, allowing JNDI injection via polymorphic typing when Default Typing is enabled and logback is in the classpath. The target version (2.18.8-tuxcare.3) already contains the upstream fix that blocks deserialization of ch.qos.logback.core.db.JNDIConnectionSource by adding it to the SubTypeValidator blocklist. This fix was shipped in the upstream release 2.18.8 (commit ad418eeb97) before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3, allowing JNDI injection via polymorphic typing when Default Typing is enabled and logback is in the classpath. The target version (2.18.8-tuxcare.3) already contains the upstream fix that blocks deserialization of ch.qos.logback.core.db.JNDIConnectionSource by adding it to the SubTypeValidator blocklist. This fix was shipped in the upstream release 2.18.8 (commit ad418eeb97) before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:51:48.439137+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects FasterXML jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing issue related to com.zaxxer.hikari.HikariConfig. The target version 2.18.8-tuxcare.3 already contains the upstream fix. The SubTypeValidator.java file includes blocklist entries for both HikariConfig and HikariDataSource (lines 105-107), preventing deserialization of these dangerous gadget types. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream release 2.18.8, which TuxCare later onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects FasterXML jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing issue related to com.zaxxer.hikari.HikariConfig. The target version 2.18.8-tuxcare.3 already contains the upstream fix. The SubTypeValidator.java file includes blocklist entries for both HikariConfig and HikariDataSource (lines 105-107), preventing deserialization of these dangerous gadget types. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream release 2.18.8, which TuxCare later onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2019-14892. The fix blocking commons-configuration JNDIConfiguration classes from polymorphic deserialization is present in SubTypeValidator.java (lines 113-114). This fix was already included in the upstream 2.18.8 release before TuxCare onboarded it, as evidenced by fix commit 41b7f9b901 being an ancestor of the first TuxCare commit 456e6e12ac. The vulnerable pattern (allowing JNDIConfiguration deserialization) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "The target jackson-databind 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2019-14892. The fix blocking commons-configuration JNDIConfiguration classes from polymorphic deserialization is present in SubTypeValidator.java (lines 113-114). This fix was already included in the upstream 2.18.8 release before TuxCare onboarded it, as evidenced by fix commit 41b7f9b901 being an ancestor of the first TuxCare commit 456e6e12ac. The vulnerable pattern (allowing JNDIConfiguration deserialization) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability allowed polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) to execute arbitrary code. The fix, which adds this class to the SubTypeValidator blocklist, is present at line 117 of SubTypeValidator.java. This fix was shipped in the upstream release (commit 998efd7082 by Tatu Saloranta) before TuxCare onboarded version 2.18.8, as confirmed by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (d3e245d364).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability allowed polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) to execute arbitrary code. The fix, which adds this class to the SubTypeValidator blocklist, is present at line 117 of SubTypeValidator.java. This fix was shipped in the upstream release (commit 998efd7082 by Tatu Saloranta) before TuxCare onboarded version 2.18.8, as confirmed by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (d3e245d364).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:41.975072+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability relates to polymorphic typing allowing deserialization of com.zaxxer.hikari.HikariDataSource, which can lead to unauthorized network connections or code execution. The fix (commit 73c1c2cc76 by upstream author Tatu Saloranta) adds HikariDataSource to the blocklist in SubTypeValidator.java and is present at line 107 of the target. This fix was already included in upstream release 2.18.8 before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability relates to polymorphic typing allowing deserialization of com.zaxxer.hikari.HikariDataSource, which can lead to unauthorized network connections or code execution. The fix (commit 73c1c2cc76 by upstream author Tatu Saloranta) adds HikariDataSource to the blocklist in SubTypeValidator.java and is present at line 107 of the target. This fix was already included in upstream release 2.18.8 before TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:15.914422+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10. The target version 2.18.8-tuxcare.3 already contains the upstream vendor fix (commit 328a0f833daf) that was shipped in the upstream 2.18.8 release. The fix adds org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource to the deserialization blacklist in SubTypeValidator.java, preventing the polymorphic typing vulnerability. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0-2.9.10. The target version 2.18.8-tuxcare.3 already contains the upstream vendor fix (commit 328a0f833daf) that was shipped in the upstream 2.18.8 release. The fix adds org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource to the deserialization blacklist in SubTypeValidator.java, preventing the polymorphic typing vulnerability. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:54.241430+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.8-tuxcare.3) is not affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization of gadget classes (com.p6spy.engine.spy.P6DataSource and org.apache.commons.dbcp DataSource classes) that enable JNDI-based remote code execution. The fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was authored by the upstream vendor (Tatu Saloranta) in commit 9593e16cf5 on 2019-09-28 and was already present in upstream version 2.18.8 when TuxCare onboarded it on 2026-07-10. The blocklist entries are active at SubTypeValidator.java lines 124-127, and the validateSubType() method enforces this blocklist during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.8-tuxcare.3) is not affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization of gadget classes (com.p6spy.engine.spy.P6DataSource and org.apache.commons.dbcp DataSource classes) that enable JNDI-based remote code execution. The fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was authored by the upstream vendor (Tatu Saloranta) in commit 9593e16cf5 on 2019-09-28 and was already present in upstream version 2.18.8 when TuxCare onboarded it on 2026-07-10. The blocklist entries are active at SubTypeValidator.java lines 124-127, and the validateSubType() method enforces this blocklist during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves Jackson's polymorphic typing feature allowing deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which can lead to arbitrary code execution. The upstream fix (commit 191a4cdf87b by Tatu Saloranta, 2019-09-19) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was already included in the upstream Jackson 2.18.8 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves Jackson's polymorphic typing feature allowing deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which can lead to arbitrary code execution. The upstream fix (commit 191a4cdf87b by Tatu Saloranta, 2019-09-19) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was already included in the upstream Jackson 2.18.8 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:51:16.476690+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath, allowing arbitrary code execution via JNDI injection through DriverManagerConnectionSource or JNDIConnectionSource classes. The target (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED because the upstream fix (commit b5a304a985) that adds these classes to the deserialization blocklist was already present in upstream release 2.18.8 before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath, allowing arbitrary code execution via JNDI injection through DriverManagerConnectionSource or JNDIConnectionSource classes. The target (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED because the upstream fix (commit b5a304a985) that adds these classes to the deserialization blocklist was already present in upstream release 2.18.8 before TuxCare onboarded it. The vulnerable pattern (missing blocklist entries) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions lacking ehcache deserialization blocking for GenericJndiSelector and GlassfishSelector classes. The target version 2.18.8 contains the upstream vendor fix (commit fc4214a883) that was already present in the upstream 2.18.8 release before TuxCare onboarding. The fix adds these two class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 134-135, preventing their deserialization. The defense is active by default via BeanDeserializerFactory's _validateSubType call during all bean deserializations, blocking the attack chain from malicious JSON type metadata to dangerous class instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 affects jackson-databind versions lacking ehcache deserialization blocking for GenericJndiSelector and GlassfishSelector classes. The target version 2.18.8 contains the upstream vendor fix (commit fc4214a883) that was already present in the upstream 2.18.8 release before TuxCare onboarding. The fix adds these two class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 134-135, preventing their deserialization. The defense is active by default via BeanDeserializerFactory's _validateSubType call during all bean deserializations, blocking the attack chain from malicious JSON type metadata to dangerous class instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:06.581572+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability concerns unsafe deserialization of ignite-jta JNDI classes, which was fixed upstream by adding three classes to the SubTypeValidator blocklist. This fix (commit a424c038ba, issue #2658) was already present in the upstream jackson-databind 2.18.8 release when TuxCare onboarded it. The vulnerable pattern does not exist in the target because the defense code shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability concerns unsafe deserialization of ignite-jta JNDI classes, which was fixed upstream by adding three classes to the SubTypeValidator blocklist. This fix (commit a424c038ba, issue #2658) was already present in the upstream jackson-databind 2.18.8 release when TuxCare onboarded it. The vulnerable pattern does not exist in the target because the defense code shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.8-tuxcare.3) is not affected by CVE-2020-10672. The vulnerability relates to unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, which could enable gadget chain exploitation. The fix - adding this class to the deserialization blocklist in SubTypeValidator.java - was already present in the upstream jackson-databind 2.18.8 release that TuxCare onboarded. The blocklist entry exists at line 163 of SubTypeValidator.java, preventing instantiation of the gadget class during polymorphic deserialization. The fix commit (592872f4235c7f2a3280725278da55544032f72d) by upstream maintainer Tatu Saloranta was made on 2020-03-15 and first shipped in jackson-databind 2.9.10.4. This commit is an ancestor of the TuxCare onboarding commit (456e6e12ac by evasilev@cloudlinux.com), confirming the fix was already in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.8-tuxcare.3) is not affected by CVE-2020-10672. The vulnerability relates to unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, which could enable gadget chain exploitation. The fix - adding this class to the deserialization blocklist in SubTypeValidator.java - was already present in the upstream jackson-databind 2.18.8 release that TuxCare onboarded. The blocklist entry exists at line 163 of SubTypeValidator.java, preventing instantiation of the gadget class during polymorphic deserialization. The fix commit (592872f4235c7f2a3280725278da55544032f72d) by upstream maintainer Tatu Saloranta was made on 2020-03-15 and first shipped in jackson-databind 2.9.10.4. This commit is an ancestor of the TuxCare onboarding commit (456e6e12ac by evasilev@cloudlinux.com), confirming the fix was already in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target repository (jackson-databind 2.18.8-tuxcare.3) already contains the upstream fix that blocks deserialization of com.caucho.config.types.ResourceRef gadget class. The fix commit 1645efbd392989cf015f459a91c999e59c921b15 by upstream author Tatu Saloranta was shipped in the upstream release 2.18.8 before TuxCare onboarded it. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4. The target repository (jackson-databind 2.18.8-tuxcare.3) already contains the upstream fix that blocks deserialization of com.caucho.config.types.ResourceRef gadget class. The fix commit 1645efbd392989cf015f459a91c999e59c921b15 by upstream author Tatu Saloranta was shipped in the upstream release 2.18.8 before TuxCare onboarded it. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for deserialization gadgets in org.aoju.bus.proxy.provider.remoting.RmiProvider. The target version 2.18.8-tuxcare.3 is NOT affected because the upstream fix (commit 05d7e0e13f, dated 2020-03-25) was already present in the upstream release 2.18.8 when TuxCare onboarded it on 2026-07-10. The vulnerable code pattern (ability to deserialize the gadget class) does not exist in the target - the malicious classes are blocked by SubTypeValidator.java lines 170-171.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for deserialization gadgets in org.aoju.bus.proxy.provider.remoting.RmiProvider. The target version 2.18.8-tuxcare.3 is NOT affected because the upstream fix (commit 05d7e0e13f, dated 2020-03-25) was already present in the upstream release 2.18.8 when TuxCare onboarded it on 2026-07-10. The vulnerable code pattern (ability to deserialize the gadget class) does not exist in the target - the malicious classes are blocked by SubTypeValidator.java lines 170-171.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for javax.swing.JEditorPane, enabling deserialization gadget attacks. The target version 2.18.8-tuxcare.3 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in the upstream release. The blocklist entry for javax.swing.JEditorPane exists at SubTypeValidator.java:150, preventing polymorphic deserialization of this gadget class. This fix was shipped in the upstream release 2.18.8 that TuxCare onboarded, not added by TuxCare backporting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for javax.swing.JEditorPane, enabling deserialization gadget attacks. The target version 2.18.8-tuxcare.3 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in the upstream release. The blocklist entry for javax.swing.JEditorPane exists at SubTypeValidator.java:150, preventing polymorphic deserialization of this gadget class. This fix was shipped in the upstream release 2.18.8 that TuxCare onboarded, not added by TuxCare backporting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The upstream vendor (FasterXML) fixed this in commit c14c9f99ed (March 2020) by adding 9 activemq classes to the SubTypeValidator blocklist. This fix was already present in upstream release 2.18.8 when TuxCare onboarded it (July 2026). The target version inherits the complete upstream fix at SubTypeValidator.java lines 173-183.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The upstream vendor (FasterXML) fixed this in commit c14c9f99ed (March 2020) by adding 9 activemq classes to the SubTypeValidator blocklist. This fix was already present in upstream release 2.18.8 when TuxCare onboarded it (July 2026). The target version inherits the complete upstream fix at SubTypeValidator.java lines 173-183.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.18.8-tuxcare.3. The upstream fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already included in the upstream release 2.18.8 that TuxCare onboarded. The blacklist entry exists at line 186 of SubTypeValidator.java and is actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.18.8-tuxcare.3. The upstream fix that blocks deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider was already included in the upstream release 2.18.8 that TuxCare onboarded. The blacklist entry exists at line 186 of SubTypeValidator.java and is actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.8-tuxcare.3 is NOT affected by CVE-2020-11113. The vulnerability involves deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to the SubTypeValidator blocklist) was introduced in upstream commit e2ba12d5d6 by FasterXML maintainer Tatu Saloranta and shipped in jackson-databind 2.10.4 (March 2020). The target version 2.18.8 (released years later) inherits this fix from the upstream release that TuxCare onboarded. The gadget class is present in the blocklist at SubTypeValidator.java:84, and the validation is on every bean deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target jackson-databind version 2.18.8-tuxcare.3 is NOT affected by CVE-2020-11113. The vulnerability involves deserialization of the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to the SubTypeValidator blocklist) was introduced in upstream commit e2ba12d5d6 by FasterXML maintainer Tatu Saloranta and shipped in jackson-databind 2.10.4 (March 2020). The target version 2.18.8 (released years later) inherits this fix from the upstream release that TuxCare onboarded. The gadget class is present in the blocklist at SubTypeValidator.java:84, and the validation is on every bean deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for Spring framework gadget classes. The target repository (jackson-databind 2.18.8-tuxcare.3) already contains the upstream fix that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The fix was introduced in upstream commit 113e89fb08b by Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-04-06 and shipped with the upstream 2.18.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for Spring framework gadget classes. The target repository (jackson-databind 2.18.8-tuxcare.3) already contains the upstream fix that blocks deserialization of org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The fix was introduced in upstream commit 113e89fb08b by Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-04-06 and shipped with the upstream 2.18.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED by CVE-2020-11620. The fix for this deserialization gadget vulnerability was already present in the upstream Jackson 2.18.8 release when TuxCare onboarded it. The class org.apache.commons.jelly.impl.Embedded is included in the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java (line 189), which actively blocks its deserialization during polymorphic type handling. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (456e6e12ac \"Onboard version 2.18.8\"), confirming this is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED by CVE-2020-11620. The fix for this deserialization gadget vulnerability was already present in the upstream Jackson 2.18.8 release when TuxCare onboarded it. The class org.apache.commons.jelly.impl.Embedded is included in the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java (line 189), which actively blocks its deserialization during polymorphic type handling. The fix commit (77040d85e3) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (456e6e12ac \"Onboard version 2.18.8\"), confirming this is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.18.8. The vulnerability affects versions before 2.9.10.5 and involves deserialization of JNDI gadget classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes). The target contains the upstream fix that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 191-195). This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) in commit d1c67a0396 and shipped in the upstream 2.18.8 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.18.8. The vulnerability affects versions before 2.9.10.5 and involves deserialization of JNDI gadget classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes). The target contains the upstream fix that adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 191-195). This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) in commit d1c67a0396 and shipped in the upstream 2.18.8 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves unsafe deserialization of oracle.jms.AQ* gadget classes. The upstream fix (commit 5c8642aeae by Tatu Saloranta, 2020-04-24) added these 5 classes to SubTypeValidator's deserialization blocklist, and this fix was already included in the 2.18.8 base release that TuxCare onboarded. All 5 oracle.jms.AQ* classes are present in DEFAULT_NO_DESER_CLASS_NAMES (SubTypeValidator.java lines 200-204) and actively enforced by validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves unsafe deserialization of oracle.jms.AQ* gadget classes. The upstream fix (commit 5c8642aeae by Tatu Saloranta, 2020-04-24) added these 5 classes to SubTypeValidator's deserialization blocklist, and this fix was already included in the 2.18.8 base release that TuxCare onboarded. All 5 oracle.jms.AQ* classes are present in DEFAULT_NO_DESER_CLASS_NAMES (SubTypeValidator.java lines 200-204) and actively enforced by validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entry for the xalan2 JNDIConnectionPool JNDI gadget class. The target version 2.18.8-tuxcare.3 is NOT affected because the upstream fix (adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to SubTypeValidator's blocklist) was already present in the upstream 2.18.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entry for the xalan2 JNDIConnectionPool JNDI gadget class. The target version 2.18.8-tuxcare.3 is NOT affected because the upstream fix (adding com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to SubTypeValidator's blocklist) was already present in the upstream 2.18.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class enabling JNDI injection attacks. The upstream fix (commit f6d9c664f6 by Tatu Saloranta) added this class to Jackson's deserialization blocklist in SubTypeValidator.java, and this fix was already present in upstream version 2.18.8 when TuxCare onboarded it. The blocklist entry at line 207 prevents instantiation of JndiRealmFactory during polymorphic deserialization, blocking the attack chain from malicious JSON input to JNDI injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class enabling JNDI injection attacks. The upstream fix (commit f6d9c664f6 by Tatu Saloranta) added this class to Jackson's deserialization blocklist in SubTypeValidator.java, and this fix was already present in upstream version 2.18.8 when TuxCare onboarded it. The blocklist entry at line 207 prevents instantiation of JndiRealmFactory during polymorphic deserialization, blocking the attack chain from malicious JSON input to JNDI injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:15.181090+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a missing blacklist entry for the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator. The target version 2.18.8-tuxcare.3 is not affected because the upstream fix (commit 3d97153944f) was already included in the upstream release 2.9.10.6 and all subsequent versions. The blacklist entry exists on line 147 of SubTypeValidator.java and is actively enforced during polymorphic deserialization via BeanDeserializerFactory, preventing exploitation of this gadget chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a missing blacklist entry for the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator. The target version 2.18.8-tuxcare.3 is not affected because the upstream fix (commit 3d97153944f) was already included in the upstream release 2.9.10.6 and all subsequent versions. The blacklist entry exists on line 147 of SubTypeValidator.java and is actively enforced during polymorphic deserialization via BeanDeserializerFactory, preventing exploitation of this gadget chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:18:09.376674+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.8-tuxcare.3 is not affected by CVE-2020-24750. The fix blocking the deserialization gadget com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in the upstream 2.18.8 release, added by upstream commit 6cc9f1a1af (author: tatu.saloranta@iki.fi) in jackson-databind 2.9.10.6 (August 2020). The blocklist entry is present in SubTypeValidator.java at line 210 and has been part of all releases since 2.9.10.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "The target jackson-databind version 2.18.8-tuxcare.3 is not affected by CVE-2020-24750. The fix blocking the deserialization gadget com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in the upstream 2.18.8 release, added by upstream commit 6cc9f1a1af (author: tatu.saloranta@iki.fi) in jackson-databind 2.9.10.6 (August 2020). The blocklist entry is present in SubTypeValidator.java at line 210 and has been part of all releases since 2.9.10.6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.18.8. The upstream fix by Tatu Saloranta (commit 612f971b78, January 2020) is already present in the codebase at DOMDeserializer.java lines 40-46. The fix adds two XML parser security features (disallow-doctype-decl=true, load-external-dtd=false) on top of the existing setExpandEntityReferences(false) protection. This fix shipped with upstream release 2.18.8, which TuxCare onboarded in commit 456e6e12ac. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.18.8. The upstream fix by Tatu Saloranta (commit 612f971b78, January 2020) is already present in the codebase at DOMDeserializer.java lines 40-46. The fix adds two XML parser security features (disallow-doctype-decl=true, load-external-dtd=false) on top of the existing setExpandEntityReferences(false) protection. This fix shipped with upstream release 2.18.8, which TuxCare onboarded in commit 456e6e12ac. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:23:14.032161+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.18.8-tuxcare.3 is NOT AFFECTED by CVE-2020-35490. The fix for this vulnerability (blocking deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) was already present in the upstream release before TuxCare onboarded version 2.18.8. The DBCP2 datasource classes are included in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:217-218, installed by upstream commit 41b8bdb5cc authored by Tatu Saloranta (tatu.saloranta@iki.fi). This upstream fix is an ancestor of the first TuxCare commit (456e6e12ac \"Onboard version 2.18.8\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "Target jackson-databind version 2.18.8-tuxcare.3 is NOT AFFECTED by CVE-2020-35490. The fix for this vulnerability (blocking deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) was already present in the upstream release before TuxCare onboarded version 2.18.8. The DBCP2 datasource classes are included in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:217-218, installed by upstream commit 41b8bdb5cc authored by Tatu Saloranta (tatu.saloranta@iki.fi). This upstream fix is an ancestor of the first TuxCare commit (456e6e12ac \"Onboard version 2.18.8\"), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:51:28.138223+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The target version 2.18.8-tuxcare.2 is NOT affected because the upstream vendor fix was already included in the 2.18.8 release. The fix (commit 41b8bdb5, authored by upstream maintainer Tatu Saloranta in December 2020) added these classes to the SubTypeValidator blocklist at lines 217-218 of SubTypeValidator.java. Git ancestry analysis confirms this fix commit predates TuxCare's onboarding commit (456e6e12ac), proving it shipped in the upstream release. The blocklist is properly enforced via BeanDeserializerFactory.validateSubType(), preventing deserialization of the dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The target version 2.18.8-tuxcare.2 is NOT affected because the upstream vendor fix was already included in the 2.18.8 release. The fix (commit 41b8bdb5, authored by upstream maintainer Tatu Saloranta in December 2020) added these classes to the SubTypeValidator blocklist at lines 217-218 of SubTypeValidator.java. Git ancestry analysis confirms this fix commit predates TuxCare's onboarding commit (456e6e12ac), proving it shipped in the upstream release. The blocklist is properly enforced via BeanDeserializerFactory.validateSubType(), preventing deserialization of the dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:55:46.062749+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2020-35728. The fix for this deserialization gadget vulnerability was already present in the upstream release that TuxCare onboarded. The gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is correctly added to the denylist in SubTypeValidator.java at line 240, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1ca0388c2f and shipped in upstream version 2.18.8 before TuxCare's onboarding commit 456e6e12ac.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "The target jackson-databind version 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2020-35728. The fix for this deserialization gadget vulnerability was already present in the upstream release that TuxCare onboarded. The gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool is correctly added to the denylist in SubTypeValidator.java at line 240, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1ca0388c2f and shipped in upstream version 2.18.8 before TuxCare's onboarding commit 456e6e12ac.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions that fail to block deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The fix (upstream commit 3ded28aece) adds this class to the SubTypeValidator blocklist. This fix is present in the target at version 2.18.8-tuxcare.3. The fix was authored by upstream maintainer Tatu Saloranta and was already included in upstream version 2.18.8 before TuxCare onboarded this version. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 affects jackson-databind versions that fail to block deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`. The fix (upstream commit 3ded28aece) adds this class to the SubTypeValidator blocklist. This fix is present in the target at version 2.18.8-tuxcare.3. The fix was authored by upstream maintainer Tatu Saloranta and was already included in upstream version 2.18.8 before TuxCare onboarded this version. The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:42:13.542842+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED by CVE-2020-36180. The fix for this vulnerability was already present in the upstream release 2.18.8 that TuxCare onboarded. The fix commit (3ded28aece) was authored by upstream maintainer Tatu Saloranta on Dec 31, 2020, and adds DriverAdapterCPDS classes to the SubTypeValidator blocklist. All five DriverAdapterCPDS variants are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java. Since this is an upstream fix that shipped in the release version, the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED by CVE-2020-36180. The fix for this vulnerability was already present in the upstream release 2.18.8 that TuxCare onboarded. The fix commit (3ded28aece) was authored by upstream maintainer Tatu Saloranta on Dec 31, 2020, and adds DriverAdapterCPDS classes to the SubTypeValidator blocklist. All five DriverAdapterCPDS variants are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java. Since this is an upstream fix that shipped in the release version, the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:45:07.357611+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability relates to a Jackson deserialization gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` that could enable remote code execution when polymorphic type handling is enabled. The fix (adding this class to the SubTypeValidator blacklist) was already included in the upstream release 2.18.8 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in commit 3ded28aece (Fixed #3004). The vulnerable pattern (missing blacklist entry) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability relates to a Jackson deserialization gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` that could enable remote code execution when polymorphic type handling is enabled. The fix (adding this class to the SubTypeValidator blacklist) was already included in the upstream release 2.18.8 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta in commit 3ded28aece (Fixed #3004). The vulnerable pattern (missing blacklist entry) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:13:47.994162+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerable class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS is blacklisted in SubTypeValidator.java (line 234), preventing its deserialization. This fix was added by upstream maintainer Tatu Saloranta in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b on December 31, 2020 (issue #3004), and was already present in upstream version 2.18.8 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerable class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS is blacklisted in SubTypeValidator.java (line 234), preventing its deserialization. This fix was added by upstream maintainer Tatu Saloranta in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b on December 31, 2020 (issue #3004), and was already present in upstream version 2.18.8 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:22:01.951264+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves a deserialization gadget class (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that could enable JNDI injection attacks. The fix, which adds this class to the SubTypeValidator blocklist, was committed upstream by Tatu Saloranta (12e23c962ff) on 2020-12-31 and was already present in the upstream 2.18.8 release when TuxCare onboarded it on 2026-07-10. The defense is active at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:243.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves a deserialization gadget class (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that could enable JNDI injection attacks. The fix, which adds this class to the SubTypeValidator blocklist, was committed upstream by Tatu Saloranta (12e23c962ff) on 2020-12-31 and was already present in the upstream 2.18.8 release when TuxCare onboarded it on 2026-07-10. The defense is active at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:243.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:33:19.742472+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target (jackson-databind 2.18.8-tuxcare.2) is not affected because the upstream fix was already present in version 2.18.8 before TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java:235-236 and are actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target (jackson-databind 2.18.8-tuxcare.2) is not affected because the upstream fix was already present in version 2.18.8 before TuxCare onboarded it. The blocklist entries exist at SubTypeValidator.java:235-236 and are actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind 2.x before 2.9.10.8 and involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The target repository (jackson-databind 2.18.8-tuxcare.3) is not affected because the vulnerability pattern is not present. The fix was already included in the upstream release 2.18.8 that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 235-236) contains the two gadget classes (PerUserPoolDataSource and SharedPoolDataSource) that would enable the attack. This fix was authored by upstream maintainer Tatu Saloranta in commit 567194c53ae on 2020-12-26, well before the 2.18.8 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind 2.x before 2.9.10.8 and involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The target repository (jackson-databind 2.18.8-tuxcare.3) is not affected because the vulnerability pattern is not present. The fix was already included in the upstream release 2.18.8 that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 235-236) contains the two gadget classes (PerUserPoolDataSource and SharedPoolDataSource) that would enable the attack. This fix was authored by upstream maintainer Tatu Saloranta in commit 567194c53ae on 2020-12-26, well before the 2.18.8 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:38:19.408252+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is a deserialization gadget vulnerability in jackson-databind where malicious JSON with type information could instantiate dangerous classes from org.apache.tomcat.dbcp.dbcp.datasources package. The target repository (jackson-databind 2.18.8-tuxcare.3) contains the upstream fix: blocklist entries for PerUserPoolDataSource and SharedPoolDataSource at lines 229-230 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3e8fa3beea on December 26, 2020, and was already present in the upstream 2.18.8 release when TuxCare onboarded it (first TuxCare commit 456e6e12ac by evasilev@cloudlinux.com). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is a deserialization gadget vulnerability in jackson-databind where malicious JSON with type information could instantiate dangerous classes from org.apache.tomcat.dbcp.dbcp.datasources package. The target repository (jackson-databind 2.18.8-tuxcare.3) contains the upstream fix: blocklist entries for PerUserPoolDataSource and SharedPoolDataSource at lines 229-230 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3e8fa3beea on December 26, 2020, and was already present in the upstream 2.18.8 release when TuxCare onboarded it (first TuxCare commit 456e6e12ac by evasilev@cloudlinux.com). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:19.112170+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.18.8-tuxcare.3 is NOT AFFECTED by CVE-2020-36187. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, Dec 26 2020) adds these classes to the deserialization deny list in SubTypeValidator.java. This fix was already present in the upstream release 2.18.8 that TuxCare onboarded, as confirmed by the fix being an ancestor of the first TuxCare commit (456e6e12ac \"Onboard version 2.18.8\"). The vulnerable code pattern is not present because the blocking defense shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "The target repository jackson-databind version 2.18.8-tuxcare.3 is NOT AFFECTED by CVE-2020-36187. The vulnerability involves unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource classes. The upstream fix (commit 3e8fa3beea by Tatu Saloranta, Dec 26 2020) adds these classes to the deserialization deny list in SubTypeValidator.java. This fix was already present in the upstream release 2.18.8 that TuxCare onboarded, as confirmed by the fix being an ancestor of the first TuxCare commit (456e6e12ac \"Onboard version 2.18.8\"). The vulnerable code pattern is not present because the blocking defense shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:07.952223+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves JNDI injection via deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The fix (commit 33d96c13fe) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing instantiation during polymorphic deserialization. This fix was already present in the upstream Jackson 2.18.8 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves JNDI injection via deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. The fix (commit 33d96c13fe) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing instantiation during polymorphic deserialization. This fix was already present in the upstream Jackson 2.18.8 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource gadget classes. The target repository (jackson-databind 2.18.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix (commit 33d96c13f by Tatu Saloranta) was already present in the upstream release 2.18.8 that TuxCare onboarded. The fix adds both dangerous classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 223-224), preventing their deserialization. The validateSubType() method enforces this blocklist at line 269, rejecting any attempt to deserialize these classes. This breaks the attack chain from malicious JSON input to execution via deserialized gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource gadget classes. The target repository (jackson-databind 2.18.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix (commit 33d96c13f by Tatu Saloranta) was already present in the upstream release 2.18.8 that TuxCare onboarded. The fix adds both dangerous classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 223-224), preventing their deserialization. The validateSubType() method enforces this blocklist at line 269, rejecting any attempt to deserialize these classes. This breaks the attack chain from malicious JSON input to execution via deserialized gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:47.001354+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 describes a Java stack overflow vulnerability via deeply nested JSON. The target version 2.18.8 contains an upstream fix that replaced the vulnerable recursive implementation (UntypedObjectDeserializer.Vanilla) with a non-recursive implementation (UntypedObjectDeserializerNR) introduced in version 2.14. The non-recursive implementation uses iteration with a heap-based scope stack instead of recursive method calls, preventing stack overflow. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) and shipped in the upstream release before TuxCare onboarded version 2.18.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 describes a Java stack overflow vulnerability via deeply nested JSON. The target version 2.18.8 contains an upstream fix that replaced the vulnerable recursive implementation (UntypedObjectDeserializer.Vanilla) with a non-recursive implementation (UntypedObjectDeserializerNR) introduced in version 2.14. The non-recursive implementation uses iteration with a heap-based scope stack instead of recursive method calls, preventing stack overflow. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) and shipped in the upstream release before TuxCare onboarded version 2.18.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 fix was already present in upstream jackson-databind 2.18.8. The vulnerable class org.apache.xbean.propertyeditor.JndiConverter is blocked by the deserialization blocklist in SubTypeValidator.java:138. This fix was authored by upstream maintainer Tatu Saloranta (commit 914e7c9f2c, Feb 2020) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 fix was already present in upstream jackson-databind 2.18.8. The vulnerable class org.apache.xbean.propertyeditor.JndiConverter is blocked by the deserialization blocklist in SubTypeValidator.java:138. This fix was authored by upstream maintainer Tatu Saloranta (commit 914e7c9f2c, Feb 2020) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.18.8-tuxcare.3 is not affected by CVE-2020-9546. The fix (denylist entry blocking deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) is present in SubTypeValidator.java at line 141. This protection was introduced in upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.8 release that TuxCare onboarded (commit 456e6e12ac). The vulnerable pattern (missing denylist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target jackson-databind 2.18.8-tuxcare.3 is not affected by CVE-2020-9546. The fix (denylist entry blocking deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) is present in SubTypeValidator.java at line 141. This protection was introduced in upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by upstream maintainer Tatu Saloranta and was already present in the upstream 2.18.8 release that TuxCare onboarded (commit 456e6e12ac). The vulnerable pattern (missing denylist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix (adding this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was committed by upstream maintainer Tatu Saloranta in commit 1e64db6a2f and was already included in upstream release 2.18.8 before TuxCare onboarded it. The blocklist protection at SubTypeValidator.java:144 is always active and prevents deserialization of the gadget class, blocking the attack at line 269 with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability involves deserialization of the gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The fix (adding this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was committed by upstream maintainer Tatu Saloranta in commit 1e64db6a2f and was already included in upstream release 2.18.8 before TuxCare onboarded it. The blocklist protection at SubTypeValidator.java:144 is always active and prevents deserialization of the gadget class, blocking the attack at line 269 with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:19:28.543087+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entries for deserialization gadget classes. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in version 2.18.8 before TuxCare onboarded it. The dangerous class br.com.anteros.dbcp.AnterosDBCPConfig is properly blocklisted in SubTypeValidator.java at line 145, preventing polymorphic deserialization exploitation. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb, which shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entries for deserialization gadget classes. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in version 2.18.8 before TuxCare onboarded it. The dangerous class br.com.anteros.dbcp.AnterosDBCPConfig is properly blocklisted in SubTypeValidator.java at line 145, preventing polymorphic deserialization exploitation. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb, which shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:16:55.064774+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 does not affect jackson-databind 2.18.8-tuxcare.3. The vulnerability involved missing blocklist entries for dangerous deserialization gadget classes (javax.swing.JTextPane and others). The fix was shipped in the upstream 2.18.8 release via commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a, which added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. TuxCare's onboarding of version 2.18.8 inherited this fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 does not affect jackson-databind 2.18.8-tuxcare.3. The vulnerability involved missing blocklist entries for dangerous deserialization gadget classes (javax.swing.JTextPane and others). The fix was shipped in the upstream 2.18.8 release via commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a, which added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. TuxCare's onboarding of version 2.18.8 inherited this fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED by CVE-2021-46877. The vulnerability concerns unbounded heap allocation during JDK deserialization of JsonNode objects, where a malicious serialized stream could declare an excessively large content length (e.g., 2GB) and force immediate allocation. The fix was introduced in upstream commit 3ccde7d938 (Dec 2021) by Tatu Saloranta, which added a 100KB allocation cap and incremental reading via ByteArrayBuilder. This fix was already present in the upstream release 2.18.8 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport. The vulnerable pattern (direct unbounded allocation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "The target repository (jackson-databind 2.18.8-tuxcare.3) is NOT AFFECTED by CVE-2021-46877. The vulnerability concerns unbounded heap allocation during JDK deserialization of JsonNode objects, where a malicious serialized stream could declare an excessively large content length (e.g., 2GB) and force immediate allocation. The fix was introduced in upstream commit 3ccde7d938 (Dec 2021) by Tatu Saloranta, which added a 100KB allocation cap and incremental reading via ByteArrayBuilder. This fix was already present in the upstream release 2.18.8 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport. The vulnerable pattern (direct unbounded allocation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability affects primitive value deserializers when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, allowing resource exhaustion through deeply nested arrays. The upstream fix (commit cd090979b7, authored by Cesar Hernandez) was already included in the upstream jackson-databind 2.18.8 release before TuxCare onboarded it. The fix adds checks in StdDeserializer and BeanDeserializer to detect and reject nested START_ARRAY tokens, preventing unbounded recursion. Both defense mechanisms are confirmed present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 is not present in jackson-databind 2.18.8-tuxcare.3. The vulnerability affects primitive value deserializers when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, allowing resource exhaustion through deeply nested arrays. The upstream fix (commit cd090979b7, authored by Cesar Hernandez) was already included in the upstream jackson-databind 2.18.8 release before TuxCare onboarded it. The fix adds checks in StdDeserializer and BeanDeserializer to detect and reject nested START_ARRAY tokens, preventing unbounded recursion. Both defense mechanisms are confirmed present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:10.906994+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.18.8-tuxcare.3. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was already shipped in the upstream 2.18.8 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() that prevents deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, blocking the resource exhaustion attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.18.8-tuxcare.3. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was already shipped in the upstream 2.18.8 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() that prevents deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, blocking the resource exhaustion attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:33:00.101658+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T20:21:46.051659+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability (stack overflow when serializing deeply nested JsonNode via toString()) was fixed in upstream version 2.14.0, and the target version 2.18.8 already includes this fix. The fix converts recursive serialization to iterative using an IteratorStack, preventing unbounded call stack growth.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability (stack overflow when serializing deeply nested JsonNode via toString()) was fixed in upstream version 2.14.0, and the target version 2.18.8 already includes this fix. The fix converts recursive serialization to iterative using an IteratorStack, preventing unbounded call stack growth."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:32:00.156734+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 Target repository jackson-databind version 2.18.8 at SHA 524a7b804 already contains the complete upstream fix for CVE-2026-54512. The fix commits (434d6c511 and 26a8c70bd) are present in git history, and the defense code is fully implemented and active in DatabindContext.java lines 286-353.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "impact_statement": "already_fixed \u2014 Target repository jackson-databind version 2.18.8 at SHA 524a7b804 already contains the complete upstream fix for CVE-2026-54512. The fix commits (434d6c511 and 26a8c70bd) are present in git history, and the defense code is fully implemented and active in DatabindContext.java lines 286-353."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2026-54513 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability (BasicPolymorphicTypeValidator.allowIfSubTypeIsArray() blindly accepting all arrays without validating component types) was fixed in the upstream 2.18.8 release. The fix commit 01d1692c8d by tatu.saloranta@iki.fi was already present when TuxCare onboarded version 2.18.8. The vulnerable code pattern (blind array matcher) has been replaced with recursive array unwrapping and component type validation. The target HEAD includes the complete fix plus additional security hardening from databind#5988.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), NVD (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), cve.org (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), Snyk (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "impact_statement": "CVE-2026-54513 is NOT present in jackson-databind 2.18.8-tuxcare.3. The vulnerability (BasicPolymorphicTypeValidator.allowIfSubTypeIsArray() blindly accepting all arrays without validating component types) was fixed in the upstream 2.18.8 release. The fix commit 01d1692c8d by tatu.saloranta@iki.fi was already present when TuxCare onboarded version 2.18.8. The vulnerable code pattern (blind array matcher) has been replaced with recursive array unwrapping and component type validation. The target HEAD includes the complete fix plus additional security hardening from databind#5988.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), NVD (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), cve.org (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), Snyk (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:32:14.632786+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.18.8-tuxcare.3 is not affected by CVE-2026-54514. The upstream fix (commit 1f5a1037b1) was already present in the 2.18.8 release when TuxCare onboarded it. The vulnerable pattern (eager DNS resolution via `new InetSocketAddress(host, port)`) has been replaced with the safe deferred-resolution pattern (`InetSocketAddress.createUnresolved(host, port)`) at FromStringD...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.18.8-tuxcare.3 is not affected by CVE-2026-54514. The upstream fix (commit 1f5a1037b1) was already present in the 2.18.8 release when TuxCare onboarded it. The vulnerable pattern (eager DNS resolution via `new InetSocketAddress(host, port)`) has been replaced with the safe deferred-resolution pattern (`InetSocketAddress.createUnresolved(host, port)`) at FromStringD..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:33:00.101658+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T03:20:00.117354+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.18.8 is NOT AFFECTED by CVE-2026-54516. The vulnerability requires code pattern introduced by issue #5398 (added in 2.21.0+) that allows properties in _ignoredPropertyNames with explicit annotations to bypass the skip check in _renameProperties. Version 2.18.8 lacks this pattern; it unconditionally skips all properties in _ignoredPropertyNames (POJOPropertiesCollector.java:1385-1386),...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "impact_statement": "not_affected \u2014 Version 2.18.8 is NOT AFFECTED by CVE-2026-54516. The vulnerability requires code pattern introduced by issue #5398 (added in 2.21.0+) that allows properties in _ignoredPropertyNames with explicit annotations to bypass the skip check in _renameProperties. Version 2.18.8 lacks this pattern; it unconditionally skips all properties in _ignoredPropertyNames (POJOPropertiesCollector.java:1385-1386),..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:43:06.956226+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2026-54517. The vulnerability describes a @JsonView bypass where view-restricted properties (particularly setterless collections/maps) could be populated from untrusted JSON despite @JsonView access control annotations. The upstream vendor (FasterXML) fixed this issue in commits addressing GitHub issues #5969 and #...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.18.8-tuxcare.3 is NOT vulnerable to CVE-2026-54517. The vulnerability describes a @JsonView bypass where view-restricted properties (particularly setterless collections/maps) could be populated from untrusted JSON despite @JsonView access control annotations. The upstream vendor (FasterXML) fixed this issue in commits addressing GitHub issues #5969 and #..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:16:31.366458+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.18.8 is not affected by CVE-2026-54518. The vulnerability exists in the `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method, which bypasses @JsonView checks when deserializing unwrapped creator parameters. This method does not exist in version 2.18.8\u2014it was introduced as part of feature #1467 (Support for @JsonUnwrapped in @JsonCreators) in commit 502fe888da on 2024-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.18.8 is not affected by CVE-2026-54518. The vulnerability exists in the `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method, which bypasses @JsonView checks when deserializing unwrapped creator parameters. This method does not exist in version 2.18.8\u2014it was introduced as part of feature #1467 (Support for @JsonUnwrapped in @JsonCreators) in commit 502fe888da on 2024-..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:48:12.131596+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.18.8-tuxcare.3 is NOT AFFECTED by CVE-2026-59888. The vulnerability, which allowed bypassing @JsonIgnore annotations on Java Record components when using PropertyNamingStrategy, was fixed in the upstream jackson-databind 2.18.8 release via commit c7c6783. This fix was already present when TuxCare onboarded version 2.18.8, as confirmed by the fix commit being an anc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.18.8-tuxcare.3 is NOT AFFECTED by CVE-2026-59888. The vulnerability, which allowed bypassing @JsonIgnore annotations on Java Record components when using PropertyNamingStrategy, was fixed in the upstream jackson-databind 2.18.8 release via commit c7c6783. This fix was already present when TuxCare onboarded version 2.18.8, as confirmed by the fix commit being an anc..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:33:00.101658+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T11:28:05.466388+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.8-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:32:00.156734+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:32:00.156734+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:33:00.101658+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T14:09:00.168778+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.18.8-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:33:00.101658+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.18.8-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}