{
  "@id": "urn:uuid:3aa6d09c-f354-4872-be35-5d7052ab5596",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 65,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:48:56.624496+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.19.0-tuxcare.2, which is significantly newer and contains the upstream fix. The defense mechanism (SubTypeValidator with blacklist) was added by upstream maintainer Tatu Saloranta in commit ddfddfba6414adbecaff99684ef66eebd3a92e92 (August 2017) and was already present in the upstream 2.19.0 release when TuxCare onboarded it. All classes specific to CVE-2017-15095 (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring PropertyPathFactoryBean, and C3P0 DataSource classes) are either explicitly blacklisted or blocked via prefix matching in SubTypeValidator.java lines 47-48, 51, and 288-297.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target is version 2.19.0-tuxcare.2, which is significantly newer and contains the upstream fix. The defense mechanism (SubTypeValidator with blacklist) was added by upstream maintainer Tatu Saloranta in commit ddfddfba6414adbecaff99684ef66eebd3a92e92 (August 2017) and was already present in the upstream 2.19.0 release when TuxCare onboarded it. All classes specific to CVE-2017-15095 (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring PropertyPathFactoryBean, and C3P0 DataSource classes) are either explicitly blacklisted or blocked via prefix matching in SubTypeValidator.java lines 47-48, 51, and 288-297.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3, allowing RCE via unsafe deserialization of Spring/C3P0/Tomcat/JDK gadget classes. The target version 2.19.0 is not affected because the fix was already present in the upstream release. The SubTypeValidator defense mechanism (commit 2235894210c75f624a3d0cd60bfb0434a20a18bf by upstream author Tatu Saloranta) was introduced in jackson-databind 2.8.11 / 2.7.9.2, which predates version 2.19.0 by thousands of commits. All CVE-2017-17485 gadget classes (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, BCEL ClassLoader, Spring AbstractPointcutAdvisor/AbstractApplicationContext hierarchies, C3P0 DataSource classes) are comprehensively blocked via exact blacklist matches or pattern matching in SubTypeValidator.java lines 47-298, with proper integration in BeanDeserializerFactory.java line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3, allowing RCE via unsafe deserialization of Spring/C3P0/Tomcat/JDK gadget classes. The target version 2.19.0 is not affected because the fix was already present in the upstream release. The SubTypeValidator defense mechanism (commit 2235894210c75f624a3d0cd60bfb0434a20a18bf by upstream author Tatu Saloranta) was introduced in jackson-databind 2.8.11 / 2.7.9.2, which predates version 2.19.0 by thousands of commits. All CVE-2017-17485 gadget classes (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, BCEL ClassLoader, Spring AbstractPointcutAdvisor/AbstractApplicationContext hierarchies, C3P0 DataSource classes) are comprehensively blocked via exact blacklist matches or pattern matching in SubTypeValidator.java lines 47-298, with proper integration in BeanDeserializerFactory.java line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:29:38.548798+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability was fixed upstream in December 2017 (commit 2235894210 by Tatu Saloranta) with the introduction of SubTypeValidator, which implements a comprehensive blacklist of dangerous deserialization gadget classes. This fix was already present in upstream version 2.19.0 before TuxCare onboarded it in September 2026. The SubTypeValidator blocks all classes specified in CVE-2017-7525 including TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, and ObjectFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability was fixed upstream in December 2017 (commit 2235894210 by Tatu Saloranta) with the introduction of SubTypeValidator, which implements a comprehensive blacklist of dangerous deserialization gadget classes. This fix was already present in upstream version 2.19.0 before TuxCare onboarded it in September 2026. The SubTypeValidator blocks all classes specified in CVE-2017-7525 including TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, and ObjectFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:20:48.274952+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.19.0-tuxcare.2. The vulnerability involved use of Jackson default typing with the org.apache.ibatis.parsing.XPathParser gadget class to enable data exfiltration via XML external entity processing. The fix (blacklisting XPathParser in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 27b4defc27 and shipped in the upstream Jackson 2.19.0 release before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:65 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.19.0-tuxcare.2. The vulnerability involved use of Jackson default typing with the org.apache.ibatis.parsing.XPathParser gadget class to enable data exfiltration via XML external entity processing. The fix (blacklisting XPathParser in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 27b4defc27 and shipped in the upstream Jackson 2.19.0 release before TuxCare onboarded it. The blacklist entry is present at SubTypeValidator.java:65 and actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:10.514084+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability was fixed in the upstream release by adding blacklist entries for Jodd-db and Oracle JDBC classes to SubTypeValidator. The fix (commits 28badf7ef6 and 7487cf7eb1) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.0 release that TuxCare onboarded. The target code contains the required blacklist entries at lines 67-72 of SubTypeValidator.java, preventing polymorphic deserialization of the vulnerable classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability was fixed in the upstream release by adding blacklist entries for Jodd-db and Oracle JDBC classes to SubTypeValidator. The fix (commits 28badf7ef6 and 7487cf7eb1) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.0 release that TuxCare onboarded. The target code contains the required blacklist entries at lines 67-72 of SubTypeValidator.java, preventing polymorphic deserialization of the vulnerable classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:21:53.187202+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability (polymorphic deserialization of Oracle JDBC classes enabling JNDI/LDAP attacks) was fixed in upstream jackson-databind 2.7.9.4/2.8.11.2/2.9.6 (June 2018). The fix\u2014blacklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java\u2014was already present in the upstream 2.19.0 release that TuxCare onboarded. The target version inherited this fix from upstream, making it not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability (polymorphic deserialization of Oracle JDBC classes enabling JNDI/LDAP attacks) was fixed in upstream jackson-databind 2.7.9.4/2.8.11.2/2.9.6 (June 2018). The fix\u2014blacklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java\u2014was already present in the upstream 2.19.0 release that TuxCare onboarded. The target version inherited this fix from upstream, making it not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:56:28.350475+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.9.7 by allowing polymorphic deserialization of dangerous classes like org.slf4j.ext.EventData. The target repository (jackson-databind 2.19.0-tuxcare.3) is not affected because the upstream fix (commit 87d29af) was already present in upstream version 2.19.0 when TuxCare onboarded it. The fix adds org.slf4j.ext.EventData and three other classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which is enforced during polymorphic deserialization via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.9.7 by allowing polymorphic deserialization of dangerous classes like org.slf4j.ext.EventData. The target repository (jackson-databind 2.19.0-tuxcare.3) is not affected because the upstream fix (commit 87d29af) was already present in upstream version 2.19.0 when TuxCare onboarded it. The fix adds org.slf4j.ext.EventData and three other classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which is enforced during polymorphic deserialization via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 by allowing arbitrary code execution through polymorphic deserialization of BlazeDS classes. The target version 2.19.0-tuxcare.3 is NOT AFFECTED. The upstream fix (commit 87d29af by Tatu Saloranta) was already present in jackson-databind 2.19.0 when TuxCare onboarded it. The dangerous classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and others from databind#2097) are blacklisted in SubTypeValidator.java and actively enforced during deserialization, preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 by allowing arbitrary code execution through polymorphic deserialization of BlazeDS classes. The target version 2.19.0-tuxcare.3 is NOT AFFECTED. The upstream fix (commit 87d29af by Tatu Saloranta) was already present in jackson-databind 2.19.0 when TuxCare onboarded it. The dangerous classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and others from databind#2097) are blacklisted in SubTypeValidator.java and actively enforced during deserialization, preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:08:55.717276+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.0-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. All four dangerous classes identified in the vendor patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the polymorphic deserialization blacklist at SubTypeValidator.java:75-78. The fix was authored by upstream Jackson maintainer Tatu Saloranta (commit 87d29af25e) and shipped in upstream release 2.19.0, which TuxCare later onboarded. The defense is active and enforced during bean deserialization via SubTypeValidator.validateSubType(), blocking instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target jackson-databind 2.19.0-tuxcare.3 is NOT AFFECTED by CVE-2018-14720. All four dangerous classes identified in the vendor patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the polymorphic deserialization blacklist at SubTypeValidator.java:75-78. The fix was authored by upstream Jackson maintainer Tatu Saloranta (commit 87d29af25e) and shipped in upstream release 2.19.0, which TuxCare later onboarded. The defense is active and enforced during bean deserialization via SubTypeValidator.validateSubType(), blocking instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:39:42.552241+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class (org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The target contains the upstream fix that blocks this class from deserialization via a blocklist in SubTypeValidator.java:78. Fix commit 87d29af25e was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.19.0 release that TuxCare onboarded (5,714 commits before the first TuxCare commit 3cbdd8b52b \"Onboard version 2.19.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class (org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The target contains the upstream fix that blocks this class from deserialization via a blocklist in SubTypeValidator.java:78. Fix commit 87d29af25e was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.19.0 release that TuxCare onboarded (5,714 commits before the first TuxCare commit 3cbdd8b52b \"Onboard version 2.19.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:51:28.138223+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT a vulnerability in jackson-databind 2.19.0. The upstream vendor (FasterXML) fixed this issue in commit 72cd4025a2 (Fix #2186) before the 2.19.0 release. The fix adds \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" and three other gadget classes to the SubTypeValidator blocklist, preventing their use in polymorphic deserialization. This fix was already present in the upstream release that TuxCare onboarded (commit 3cbdd8b5), making the target version safe from this CVE by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT a vulnerability in jackson-databind 2.19.0. The upstream vendor (FasterXML) fixed this issue in commit 72cd4025a2 (Fix #2186) before the 2.19.0 release. The fix adds \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" and three other gadget classes to the SubTypeValidator blocklist, preventing their use in polymorphic deserialization. This fix was already present in the upstream release that TuxCare onboarded (commit 3cbdd8b5), making the target version safe from this CVE by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:57:30.465792+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability concerns polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The vendor fix adds these classes to a deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.19.0 when TuxCare onboarded it (commit 72cd4025a2 from 2018-11-19 by Tatu Saloranta is an ancestor of the first TuxCare onboarding commit 3cbdd8b52b). The target contains the complete fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 82-83.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability concerns polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The vendor fix adds these classes to a deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.19.0 when TuxCare onboarded it (commit 72cd4025a2 from 2018-11-19 by Tatu Saloranta is an ancestor of the first TuxCare onboarding commit 3cbdd8b52b). The target contains the complete fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java lines 82-83.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:25:39.175944+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream vendor (FasterXML) fixed this in commit 72cd4025a229fb28ec133235003dd4616f70afaa by adding the vulnerable class to the SubTypeValidator blocklist. This fix was already included in the upstream jackson-databind 2.19.0 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream vendor (FasterXML) fixed this in commit 72cd4025a229fb28ec133235003dd4616f70afaa by adding the vulnerable class to the SubTypeValidator blocklist. This fix was already included in the upstream jackson-databind 2.19.0 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.19.0. The vulnerability required two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to be absent from the deserialization blacklist. The target version contains these entries in SubTypeValidator.java (lines 62-63), preventing deserialization of these dangerous classes. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.0 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.19.0. The vulnerability required two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to be absent from the deserialization blacklist. The target version contains these entries in SubTypeValidator.java (lines 62-63), preventing deserialization of these dangerous classes. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.0 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:54.438603+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.0-tuxcare.3 is NOT affected by CVE-2018-7489. The fix blocking c3p0 DataSource deserialization gadgets is present in SubTypeValidator.java (lines 288-298), including the PREFIX_C3P0 constant and pattern-based validation that rejects any class matching \"com.mchange.v2.c3p0.*DataSource\". This fix was shipped in upstream release 2.19.0 (commit 6799f8f1 by tatu.saloranta@iki.fi), before TuxCare onboarded the version. The vulnerable pattern described in the CVE is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "The target jackson-databind 2.19.0-tuxcare.3 is NOT affected by CVE-2018-7489. The fix blocking c3p0 DataSource deserialization gadgets is present in SubTypeValidator.java (lines 288-298), including the PREFIX_C3P0 constant and pattern-based validation that rejects any class matching \"com.mchange.v2.c3p0.*DataSource\". This fix was shipped in upstream release 2.19.0 (commit 6799f8f1 by tatu.saloranta@iki.fi), before TuxCare onboarded the version. The vulnerable pattern described in the CVE is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:35:21.882986+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.0 is NOT AFFECTED by CVE-2019-12086. The upstream vendor (FasterXML) fixed this polymorphic deserialization vulnerability in jackson-databind 2.9.9 by adding com.mysql.cj.jdbc.admin.MiniAdmin to the SubTypeValidator blocklist. This fix was already present in upstream 2.19.0 when TuxCare onboarded it. The target contains the complete defense: SubTypeValidator.java line 88 blocks MiniAdmin deserialization, and BeanDeserializerFactory mandatorily invokes this validation. The vulnerable pattern (unrestricted polymorphic deserialization of the MiniAdmin gadget) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "Target version 2.19.0 is NOT AFFECTED by CVE-2019-12086. The upstream vendor (FasterXML) fixed this polymorphic deserialization vulnerability in jackson-databind 2.9.9 by adding com.mysql.cj.jdbc.admin.MiniAdmin to the SubTypeValidator blocklist. This fix was already present in upstream 2.19.0 when TuxCare onboarded it. The target contains the complete defense: SubTypeValidator.java line 88 blocks MiniAdmin deserialization, and BeanDeserializerFactory mandatorily invokes this validation. The vulnerable pattern (unrestricted polymorphic deserialization of the MiniAdmin gadget) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T18:40:04.693122+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind 2.x before 2.9.9.1 due to failure to block logback-core class from polymorphic deserialization. The target version 2.19.0-tuxcare.3 contains the upstream fix (commit c9ef4a10d6) that adds ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was shipped in upstream version 2.9.9.1 and was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind 2.x before 2.9.9.1 due to failure to block logback-core class from polymorphic deserialization. The target version 2.19.0-tuxcare.3 contains the upstream fix (commit c9ef4a10d6) that adds ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java. This fix was shipped in upstream version 2.9.9.1 and was ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T07:20:42.448866+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind when Default Typing is enabled and JDOM jars are in classpath, allowing arbitrary file reads via malicious JSON. The fix (commit 5f7c69bba0) adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist. This fix is present in the target at version 2.19.0-tuxcare.3 and was already included in the upstream r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind when Default Typing is enabled and JDOM jars are in classpath, allowing arbitrary file reads via malicious JSON. The fix (commit 5f7c69bba0) adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist. This fix is present in the target at version 2.19.0-tuxcare.3 and was already included in the upstream r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:13:29.842653+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.19.0. The vulnerability involved missing blocklist entries for dangerous gadget classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via polymorphic deserialization. The upstream vendor fix (commit ad418eeb97) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.19.0. The vulnerability involved missing blocklist entries for dangerous gadget classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that could enable remote code execution via polymorphic deserialization. The upstream vendor fix (commit ad418eeb97) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:33:56.225785+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.19.0. The vulnerability involved missing blacklist entry for ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator, which could allow JNDI injection via polymorphic deserialization. The fix was applied by upstream maintainer Tatu Saloranta in commit ad418eeb on 2019-07-25 and was already present in the upstream jackson-databind 2.19.0 release that TuxCare onboarded on 2026-09-20. The target contains the complete fix at line 102 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.19.0. The vulnerability involved missing blacklist entry for ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator, which could allow JNDI injection via polymorphic deserialization. The fix was applied by upstream maintainer Tatu Saloranta in commit ad418eeb on 2019-07-25 and was already present in the upstream jackson-databind 2.19.0 release that TuxCare onboarded on 2026-09-20. The target contains the complete fix at line 102 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability was fixed by upstream commits d4983c740f and 73c1c2cc76, which added com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist in SubTypeValidator.java. These upstream fixes were already present in jackson-databind 2.19.0 before TuxCare onboarded it (both fix commits are ancestors of the first TuxCare commit 3cbdd8b5). The blocklist entries are verified at lines 105 and 107 of SubTypeValidator.java, and the validator is actively invoked during bean deserialization at BeanDeserializerFactory line 142, preventing polymorphic deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability was fixed by upstream commits d4983c740f and 73c1c2cc76, which added com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist in SubTypeValidator.java. These upstream fixes were already present in jackson-databind 2.19.0 before TuxCare onboarded it (both fix commits are ancestors of the first TuxCare commit 3cbdd8b5). The blocklist entries are verified at lines 105 and 107 of SubTypeValidator.java, and the validator is actively invoked during bean deserialization at BeanDeserializerFactory line 142, preventing polymorphic deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:36.777269+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 via polymorphic deserialization of commons-configuration JNDIConfiguration classes leading to arbitrary code execution. The target (jackson-databind 2.19.0-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the upstream release 2.19.0 before TuxCare onboarded it. The fix adds \"org.apache.commons.configuration.JNDIConfiguration\" and \"org.apache.commons.configuration2.JNDIConfiguration\" to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their deserialization. This fix was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b901, which is an ancestor of HEAD and predates the first TuxCare commit (onboarding commit 3cbdd8b52b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 via polymorphic deserialization of commons-configuration JNDIConfiguration classes leading to arbitrary code execution. The target (jackson-databind 2.19.0-tuxcare.3) is NOT AFFECTED because the upstream vendor fix was already present in the upstream release 2.19.0 before TuxCare onboarded it. The fix adds \"org.apache.commons.configuration.JNDIConfiguration\" and \"org.apache.commons.configuration2.JNDIConfiguration\" to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their deserialization. This fix was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 41b7f9b901, which is an ancestor of HEAD and predates the first TuxCare commit (onboarding commit 3cbdd8b52b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves polymorphic deserialization of the malicious xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) which could lead to arbitrary code execution. The fix blocking this class was already present in the upstream 2.19.0 release that TuxCare onboarded, as evidenced by commit 998efd708284778f29d83d7962a9bd935c228317 by upstream maintainer Tatu Saloranta, which predates all TuxCare work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves polymorphic deserialization of the malicious xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) which could lead to arbitrary code execution. The fix blocking this class was already present in the upstream 2.19.0 release that TuxCare onboarded, as evidenced by commit 998efd708284778f29d83d7962a9bd935c228317 by upstream maintainer Tatu Saloranta, which predates all TuxCare work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:57.029053+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is not present in jackson-databind 2.19.0-tuxcare.3. The fix preventing polymorphic deserialization of com.zaxxer.hikari.HikariDataSource was already included in the upstream jackson-databind 2.19.0 release. The blocklist entry was added by upstream maintainer Tatu Saloranta in commit 73c1c2cc76e (2019-09-12), which predates the TuxCare onboarding commit. The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is not present in jackson-databind 2.19.0-tuxcare.3. The fix preventing polymorphic deserialization of com.zaxxer.hikari.HikariDataSource was already included in the upstream jackson-databind 2.19.0 release. The blocklist entry was added by upstream maintainer Tatu Saloranta in commit 73c1c2cc76e (2019-09-12), which predates the TuxCare onboarding commit. The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability allowed polymorphic deserialization of dangerous org.apache.commons.dbcp.datasources classes (PerUserPoolDataSource, SharedPoolDataSource) that could lead to RCE. The fix was already present in the upstream release 2.9.10.1/2.10.1 (September 2019) before TuxCare onboarded version 2.19.0. SubTypeValidator contains both dangerous classes in its DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 124-125), and validateSubType() actively prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability allowed polymorphic deserialization of dangerous org.apache.commons.dbcp.datasources classes (PerUserPoolDataSource, SharedPoolDataSource) that could lead to RCE. The fix was already present in the upstream release 2.9.10.1/2.10.1 (September 2019) before TuxCare onboarded version 2.19.0. SubTypeValidator contains both dangerous classes in its DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 124-125), and validateSubType() actively prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:17:09.184138+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.19.0. The vulnerability involved polymorphic deserialization of com.p6spy.engine.spy.P6DataSource allowing RCE when Default Typing is enabled. The fix (blocking P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource in SubTypeValidator) was contributed by upstream maintainer Tatu Saloranta in commit 9593e16cf5 (September 2019) and shipped in the upstream 2.19.0 release that TuxCare onboarded. The dangerous classes are blocklisted in SubTypeValidator.java lines 121-127, and this validation is mandatory during bean deserialization (BeanDeserializerFactory line 142).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.19.0. The vulnerability involved polymorphic deserialization of com.p6spy.engine.spy.P6DataSource allowing RCE when Default Typing is enabled. The fix (blocking P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource in SubTypeValidator) was contributed by upstream maintainer Tatu Saloranta in commit 9593e16cf5 (September 2019) and shipped in the upstream 2.19.0 release that TuxCare onboarded. The dangerous classes are blocklisted in SubTypeValidator.java lines 121-127, and this validation is mandatory during bean deserialization (BeanDeserializerFactory line 142).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.19.0-tuxcare.3) already contains the upstream fix. The dangerous class is blocklisted in SubTypeValidator.java at line 99, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b (dated 2019-09-19) and was already present in the upstream release when TuxCare onboarded version 2.19.0 on 2026-09-20. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.19.0-tuxcare.3) already contains the upstream fix. The dangerous class is blocklisted in SubTypeValidator.java at line 99, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b (dated 2019-09-19) and was already present in the upstream release when TuxCare onboarded version 2.19.0 on 2026-09-20. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:19.112170+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves polymorphic deserialization of apache-log4j-extras classes that enable JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the SubTypeValidator blacklist. This fix was already present in upstream release 2.19.0 before TuxCare onboarded the project, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves polymorphic deserialization of apache-log4j-extras classes that enable JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by adding org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the SubTypeValidator blacklist. This fix was already present in upstream release 2.19.0 before TuxCare onboarded the project, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI injection attacks through unsafe deserialization. The fix was already present in the upstream jackson-databind 2.19.0 release, as confirmed by commit fc4214a883 (authored by upstream maintainer Tatu Saloranta on 2019-11-01), which added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. TuxCare onboarded version 2.19.0 with this fix already included.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI injection attacks through unsafe deserialization. The fix was already present in the upstream jackson-databind 2.19.0 release, as confirmed by commit fc4214a883 (authored by upstream maintainer Tatu Saloranta on 2019-11-01), which added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. TuxCare onboarded version 2.19.0 with this fix already included.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:58.617275+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target version 2.19.0-tuxcare.3 already contains the upstream fix (commit a424c038ba) that was shipped in jackson-databind 2.19.0. The fix adds three class names to the deserialization blocklist in SubTypeValidator.java: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was present in the upstream release before TuxCare onboarded version 2.19.0, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target version 2.19.0-tuxcare.3 already contains the upstream fix (commit a424c038ba) that was shipped in jackson-databind 2.19.0. The fix adds three class names to the deserialization blocklist in SubTypeValidator.java: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This fix was present in the upstream release before TuxCare onboarded version 2.19.0, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.0-tuxcare.3 is NOT AFFECTED by CVE-2020-10672. The upstream fix that blacklists the aries.transaction.jms gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory) was already present in the upstream jackson-databind 2.19.0 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in March 2020 and is properly enforced by the SubTypeValidator.validateSubType() method during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target jackson-databind 2.19.0-tuxcare.3 is NOT AFFECTED by CVE-2020-10672. The upstream fix that blacklists the aries.transaction.jms gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory) was already present in the upstream jackson-databind 2.19.0 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in March 2020 and is properly enforced by the SubTypeValidator.validateSubType() method during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is a deserialization gadget vulnerability affecting jackson-databind versions before 2.9.10.4, involving com.caucho.config.types.ResourceRef (caucho-quercus). The vendor fix adds this class to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java to prevent polymorphic deserialization attacks. The target repository (jackson-databind 2.19.0-tuxcare.3) already contains this fix, which was introduced by upstream commit 1645efbd39 authored by Tatu Saloranta and was part of the upstream 2.19.0 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is a deserialization gadget vulnerability affecting jackson-databind versions before 2.9.10.4, involving com.caucho.config.types.ResourceRef (caucho-quercus). The vendor fix adds this class to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java to prevent polymorphic deserialization attacks. The target repository (jackson-databind 2.19.0-tuxcare.3) already contains this fix, which was introduced by upstream commit 1645efbd39 authored by Tatu Saloranta and was part of the upstream 2.19.0 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.0 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves deserialization gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) adds these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.19.0 before TuxCare onboarded it (first TuxCare commit 3cbdd8b52b \"Onboard version 2.19.0\"). The blocklist prevents instantiation of these gadget classes during polymorphic deserialization, blocking the attack chain from Input (JSON with type metadata) to Goal (arbitrary code execution). Version 2.19.0 is significantly newer than 2.9.10.4 (the version where CVE-2020-10968 was fixed upstream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target jackson-databind 2.19.0 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves deserialization gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream fix (commit 05d7e0e13f by Tatu Saloranta) adds these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.19.0 before TuxCare onboarded it (first TuxCare commit 3cbdd8b52b \"Onboard version 2.19.0\"). The blocklist prevents instantiation of these gadget classes during polymorphic deserialization, blocking the attack chain from Input (JSON with type metadata) to Goal (arbitrary code execution). Version 2.19.0 is significantly newer than 2.9.10.4 (the version where CVE-2020-10968 was fixed upstream).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability concerns deserialization gadgets involving javax.swing.JEditorPane in versions before 2.9.10.4. The fix (adding javax.swing.JEditorPane to the blocklist in SubTypeValidator.java) was applied by upstream author Tatu Saloranta in commit 6ba48457984943df0de92c54144f7dcae01b1221, which was already present in the upstream release 2.19.0 that TuxCare onboarded. The blocklist entry is present at line 150 of SubTypeValidator.java and actively prevents deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability concerns deserialization gadgets involving javax.swing.JEditorPane in versions before 2.9.10.4. The fix (adding javax.swing.JEditorPane to the blocklist in SubTypeValidator.java) was applied by upstream author Tatu Saloranta in commit 6ba48457984943df0de92c54144f7dcae01b1221, which was already present in the upstream release 2.19.0 that TuxCare onboarded. The blocklist entry is present at line 150 of SubTypeValidator.java and actively prevents deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves deserialization of org.apache.activemq.* gadget classes that can lead to remote code execution. The upstream vendor (FasterXML) fixed this by adding these classes to a blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.19.0 before TuxCare onboarded it, as confirmed by commit 08fbfacf89 being an ancestor of the onboarding commit 3cbdd8b52b. All nine activemq classes from the vendor patches are present in the target's blocklist (lines 175-183 of SubTypeValidator.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves deserialization of org.apache.activemq.* gadget classes that can lead to remote code execution. The upstream vendor (FasterXML) fixed this by adding these classes to a blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.19.0 before TuxCare onboarded it, as confirmed by commit 08fbfacf89 being an ancestor of the onboarding commit 3cbdd8b52b. All nine activemq classes from the vendor patches are present in the target's blocklist (lines 175-183 of SubTypeValidator.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target is NOT AFFECTED by CVE-2020-11112. The fix (blacklisting org.apache.commons.proxy.provider.remoting.RmiProvider in SubTypeValidator) was authored by upstream vendor Tatu Saloranta (commit 05d7e0e13f, March 2020) and shipped in jackson-databind 2.19.0 upstream release before TuxCare onboarded it. The blacklist entry is present at line 186 of SubTypeValidator.java and actively enforced by the validateSubType method, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target is NOT AFFECTED by CVE-2020-11112. The fix (blacklisting org.apache.commons.proxy.provider.remoting.RmiProvider in SubTypeValidator) was authored by upstream vendor Tatu Saloranta (commit 05d7e0e13f, March 2020) and shipped in jackson-databind 2.19.0 upstream release before TuxCare onboarded it. The blacklist entry is present at line 186 of SubTypeValidator.java and actively enforced by the validateSubType method, preventing deserialization of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.openjpa.ee.WASRegistryManagedRuntime). The target repository (jackson-databind 2.19.0-tuxcare.3) already contains the upstream fix that blocks this class from being deserialized. The fix (commit e2ba12d5d60715d95105e3e790fc234cfb59893d by Tatu Saloranta) was included in the upstream 2.19.0 release that TuxCare onboarded. SubTypeValidator.java line 84 contains the blocklist entry, and validation is enforced unconditionally in BeanDeserializerFactory before any deserializer is constructed. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.openjpa.ee.WASRegistryManagedRuntime). The target repository (jackson-databind 2.19.0-tuxcare.3) already contains the upstream fix that blocks this class from being deserialized. The fix (commit e2ba12d5d60715d95105e3e790fc234cfb59893d by Tatu Saloranta) was included in the upstream 2.19.0 release that TuxCare onboarded. SubTypeValidator.java line 84 contains the blocklist entry, and validation is enforced unconditionally in BeanDeserializerFactory before any deserializer is constructed. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.0-tuxcare.3 is NOT affected by CVE-2020-11619. The upstream vendor's fix (commit 113e89fb08, April 2020) was already included in jackson-databind 2.19.0 when TuxCare onboarded it in September 2026. The vulnerable Spring AOP/beans factory classes (MethodLocatingFactoryBean, BeanReferenceFactoryBean) are blocked via SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 52-54), preventing their instantiation during polymorphic JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target jackson-databind 2.19.0-tuxcare.3 is NOT affected by CVE-2020-11619. The upstream vendor's fix (commit 113e89fb08, April 2020) was already included in jackson-databind 2.19.0 when TuxCare onboarded it in September 2026. The vulnerable Spring AOP/beans factory classes (MethodLocatingFactoryBean, BeanReferenceFactoryBean) are blocked via SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 52-54), preventing their instantiation during polymorphic JSON deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the deserialization gadget class org.apache.commons.jelly.impl.Embedded. The target version 2.19.0-tuxcare.3 already contains the upstream fix that adds this class to the SubTypeValidator blocklist at line 189. The fix commits (77040d85e3, 08fbfacf89) were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.0 release before TuxCare onboarding (commit 3cbdd8b52b). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the deserialization gadget class org.apache.commons.jelly.impl.Embedded. The target version 2.19.0-tuxcare.3 already contains the upstream fix that adds this class to the SubTypeValidator blocklist at line 189. The fix commits (77040d85e3, 08fbfacf89) were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.0 release before TuxCare onboarding (commit 3cbdd8b52b). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5, related to deserialization gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository at version 2.19.0-tuxcare.3 is NOT affected. The vulnerability pattern is not present because the upstream fix was already included in the 2.19.0 release that TuxCare onboarded. The gadget class is blacklisted at SubTypeValidator.java:192, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921) on April 24, 2020, and shipped in upstream version 2.9.10.5, well before the 2.19.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5, related to deserialization gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target repository at version 2.19.0-tuxcare.3 is NOT affected. The vulnerability pattern is not present because the upstream fix was already included in the 2.19.0 release that TuxCare onboarded. The gadget class is blacklisted at SubTypeValidator.java:192, preventing its deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921) on April 24, 2020, and shipped in upstream version 2.9.10.5, well before the 2.19.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.19.0-tuxcare.3) is not affected by CVE-2020-14061. The five Oracle JMS classes identified in the CVE (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the blocklist in SubTypeValidator.java (lines 200-204), preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 5c8642aeae) and was already included in upstream release 2.19.0 before TuxCare onboarded it. The CVE affects versions \"2.x before 2.9.10.5\", and 2.19.0 is significantly newer than the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "The target (jackson-databind 2.19.0-tuxcare.3) is not affected by CVE-2020-14061. The five Oracle JMS classes identified in the CVE (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the blocklist in SubTypeValidator.java (lines 200-204), preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 5c8642aeae) and was already included in upstream release 2.19.0 before TuxCare onboarded it. The CVE affects versions \"2.x before 2.9.10.5\", and 2.19.0 is significantly newer than the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target is version 2.19.0, which already contains the upstream fix. The blocklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is present at SubTypeValidator.java:119, added by upstream commit 840eae2ca81 (Tatu Saloranta, 2020-05-01). This commit predates TuxCare's onboarding of version 2.19.0, confirming the fix was shipped in the upstream release. The SubTypeValidator blocks instantiation of this gadget class during polymorphic deserialization, preventing JNDI injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target is version 2.19.0, which already contains the upstream fix. The blocklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is present at SubTypeValidator.java:119, added by upstream commit 840eae2ca81 (Tatu Saloranta, 2020-05-01). This commit predates TuxCare's onboarding of version 2.19.0, confirming the fix was shipped in the upstream release. The SubTypeValidator blocks instantiation of this gadget class during polymorphic deserialization, preventing JNDI injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability relates to unsafe deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class allowing RCE via JNDI injection. The upstream jackson-databind project fixed this in version 2.9.10.5 (June 2020) by adding the class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release that TuxCare onboarded, so the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability relates to unsafe deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class allowing RCE via JNDI injection. The upstream jackson-databind project fixed this in version 2.9.10.5 (June 2020) by adding the class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release that TuxCare onboarded, so the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:20:14.370746+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.19.0-tuxcare.3) is NOT affected by CVE-2020-24616. The vulnerability pattern is not present because the upstream vendor's fix was already included in the upstream release 2.19.0 when TuxCare onboarded it. The fix adds \"br.com.anteros.dbcp.AnterosDBCPDataSource\" to the deserialization blocklist in SubTypeValidator.java (line 147), preventing exploitation of this serialization gadget. Fix commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream FasterXML/Jackson maintainer, and is an ancestor of the first TuxCare onboarding commit (3cbdd8b52b2b7200c81f89f373157b945ad72200 \"Onboard version 2.19.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "The target repository (jackson-databind 2.19.0-tuxcare.3) is NOT affected by CVE-2020-24616. The vulnerability pattern is not present because the upstream vendor's fix was already included in the upstream release 2.19.0 when TuxCare onboarded it. The fix adds \"br.com.anteros.dbcp.AnterosDBCPDataSource\" to the deserialization blocklist in SubTypeValidator.java (line 147), preventing exploitation of this serialization gadget. Fix commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream FasterXML/Jackson maintainer, and is an ancestor of the first TuxCare onboarding commit (3cbdd8b52b2b7200c81f89f373157b945ad72200 \"Onboard version 2.19.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:59.584312+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is NOT present in jackson-databind 2.19.0. The fix that blocks deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration was already shipped in the upstream 2.19.0 release. The blocklist entry exists at SubTypeValidator.java:209-210, and the validation is active by default during polymorphic deserialization, preventing exploitation of this JNDI injection gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is NOT present in jackson-databind 2.19.0. The fix that blocks deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration was already shipped in the upstream 2.19.0 release. The blocklist entry exists at SubTypeValidator.java:209-210, and the validation is active by default during polymorphic deserialization, preventing exploitation of this JNDI injection gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The upstream fix authored by Tatu Saloranta (commit 612f971b78c, January 2020) was already present in the upstream 2.19.0 release that TuxCare onboarded in September 2026. The fix adds two critical XML parser features: disallow-doctype-decl=true and load-external-dtd=false, which prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading in DOMDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "The target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The upstream fix authored by Tatu Saloranta (commit 612f971b78c, January 2020) was already present in the upstream 2.19.0 release that TuxCare onboarded in September 2026. The fix adds two critical XML parser features: disallow-doctype-decl=true and load-external-dtd=false, which prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading in DOMDeserializer.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:21:46.608783+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2020-35490. The vulnerability concerns deserialization of dangerous gadget classes (org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) that can lead to arbitrary code execution. The fix, which adds these classes to the deserialization blacklist, was already present in the upstream 2.19.0 release before TuxCare onboarded it. The upstream fix commit 41b8bdb5cc by Tatu Saloranta was applied on Dec 15, 2020, and is an ancestor of the TuxCare onboarding commit 3cbdd8b52b from 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2020-35490. The vulnerability concerns deserialization of dangerous gadget classes (org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) that can lead to arbitrary code execution. The fix, which adds these classes to the deserialization blacklist, was already present in the upstream 2.19.0 release before TuxCare onboarded it. The upstream fix commit 41b8bdb5cc by Tatu Saloranta was applied on Dec 15, 2020, and is an ancestor of the TuxCare onboarding commit 3cbdd8b52b from 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:21.485909+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource gadget classes. The target is jackson-databind 2.19.0-tuxcare.2. The upstream fix (commit 41b8bdb5 by Tatu Saloranta, released in 2.9.10.8) adds these dangerous classes to the SubTypeValidator blocklist. This fix was already present in upstream 2.19.0, which TuxCare onboarded, so the vulnerability was never present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource gadget classes. The target is jackson-databind 2.19.0-tuxcare.2. The upstream fix (commit 41b8bdb5 by Tatu Saloranta, released in 2.9.10.8) adds these dangerous classes to the SubTypeValidator blocklist. This fix was already present in upstream 2.19.0, which TuxCare onboarded, so the vulnerability was never present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:51.888467+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability concerns deserialization gadgets allowing remote code execution via JNDI injection through the class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was applied in version 2.9.10.8 by FasterXML maintainer Tatu Saloranta (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84). This fix was already present in upstream version 2.19.0 when TuxCare onboarded it, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability concerns deserialization gadgets allowing remote code execution via JNDI injection through the class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (adding this class to the deserialization blacklist in SubTypeValidator.java) was applied in version 2.9.10.8 by FasterXML maintainer Tatu Saloranta (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84). This fix was already present in upstream version 2.19.0 when TuxCare onboarded it, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:58.768798+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` which could lead to code execution. The upstream fix (commit 3ded28aece by Tatu Saloranta, Dec 31 2020) added this class and related DriverAdapterCPDS variants to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.19.0 release before TuxCare onboarded it (first TuxCare commit: 3cbdd8b52b \"Onboard version 2.19.0\"). The blocklist is enforced via a singleton SubTypeValidator instance that runs automatically during bean deserialization and cannot be disabled or bypassed through configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` which could lead to code execution. The upstream fix (commit 3ded28aece by Tatu Saloranta, Dec 31 2020) added this class and related DriverAdapterCPDS variants to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.19.0 release before TuxCare onboarded it (first TuxCare commit: 3cbdd8b52b \"Onboard version 2.19.0\"). The blocklist is enforced via a singleton SubTypeValidator instance that runs automatically during bean deserialization and cannot be disabled or bypassed through configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:36:59.729049+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS deserialization gadget. The target repository jackson-databind:2.19.0-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already present in the upstream 2.19.0 release that TuxCare onboarded. The vulnerable gadget class and its variants are blocked in SubTypeValidator.java lines 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS deserialization gadget. The target repository jackson-databind:2.19.0-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already present in the upstream 2.19.0 release that TuxCare onboarded. The vulnerable gadget class and its variants are blocked in SubTypeValidator.java lines 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:41:53.192155+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8. The target version 2.19.0-tuxcare.3 already contains the upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The fix was authored by upstream maintainer Tatu Saloranta (commit 3ded28aece6) and was already present in the upstream release 2.19.0 when TuxCare onboarded it. The vulnerable gadget class is added to SubTypeValidator's blocklist at line 228, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8. The target version 2.19.0-tuxcare.3 already contains the upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The fix was authored by upstream maintainer Tatu Saloranta (commit 3ded28aece6) and was already present in the upstream release 2.19.0 when TuxCare onboarded it. The vulnerable gadget class is added to SubTypeValidator's blocklist at line 228, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:59.877228+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 concerns a deserialization gadget vulnerability where Jackson databind could be exploited to execute arbitrary code by deserializing the class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository (jackson-databind version 2.19.0-tuxcare.3) is NOT affected because the upstream fix (commit 3ded28aece6 by Tatu Saloranta, dated Dec 31, 2020) was already present in the upstream 2.19.0 release that TuxCare onboarded. The fix adds the malicious class to the deserialization blocklist in SubTypeValidator.java at line 234, preventing Jackson from instantiating it during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 concerns a deserialization gadget vulnerability where Jackson databind could be exploited to execute arbitrary code by deserializing the class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository (jackson-databind version 2.19.0-tuxcare.3) is NOT affected because the upstream fix (commit 3ded28aece6 by Tatu Saloranta, dated Dec 31, 2020) was already present in the upstream 2.19.0 release that TuxCare onboarded. The fix adds the malicious class to the deserialization blocklist in SubTypeValidator.java at line 234, preventing Jackson from instantiating it during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:21:12.185577+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 concerns a deserialization gadget in jackson-databind that enables JNDI injection attacks through the class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.19.0-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 12e23c962f by Tatu Saloranta) shipped in the upstream release 2.19.0 that TuxCare onboarded. The gadget class is blocklisted in SubTypeValidator.java:243, preventing instantiation during polymorphic deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 concerns a deserialization gadget in jackson-databind that enables JNDI injection attacks through the class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.19.0-tuxcare.3 is NOT AFFECTED because the upstream fix (commit 12e23c962f by Tatu Saloranta) shipped in the upstream release 2.19.0 that TuxCare onboarded. The gadget class is blocklisted in SubTypeValidator.java:243, preventing instantiation during polymorphic deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.19.0 is not affected by CVE-2020-36184. The vulnerability was fixed in upstream version 2.9.10.8 (December 2020) by adding the gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist. This fix (commit 567194c53a by upstream maintainer Tatu Saloranta) was already present in the upstream 2.19.0 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "The target repository jackson-databind version 2.19.0 is not affected by CVE-2020-36184. The vulnerability was fixed in upstream version 2.9.10.8 (December 2020) by adding the gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist. This fix (commit 567194c53a by upstream maintainer Tatu Saloranta) was already present in the upstream 2.19.0 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:30.945793+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 targets the deserialization gadget class org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource in jackson-databind. The target version 2.19.0-tuxcare.3 contains the upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) which adds SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java at line 236. The fix prevents instantiation of this gadget class during polymorphic deserialization, blocking the attack vector. Attribution analysis shows this is an upstream fix (author tatu.saloranta@iki.fi, not in TuxCare allowlist) merged via normal version progression, with no TuxCare attribution signals (A1/A2/A3/A4 all failed). Verdict: not_affected with upstream fix present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 targets the deserialization gadget class org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource in jackson-databind. The target version 2.19.0-tuxcare.3 contains the upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) which adds SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java at line 236. The fix prevents instantiation of this gadget class during polymorphic deserialization, blocking the attack vector. Attribution analysis shows this is an upstream fix (author tatu.saloranta@iki.fi, not in TuxCare allowlist) merged via normal version progression, with no TuxCare attribution signals (A1/A2/A3/A4 all failed). Verdict: not_affected with upstream fix present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:33:03.457896+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to missing denylist entries for org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource, allowing deserialization gadget exploitation. The target repository (jackson-databind 2.19.0-tuxcare.3) contains the upstream fix commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, which adds these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release that TuxCare onboarded (commit 3cbdd8b52b \"Onboard version 2.19.0\"), not a TuxCare backport. The denylist is enforced by default during type resolution via validateSubType(), blocking instantiation of these gadget classes and preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to missing denylist entries for org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource, allowing deserialization gadget exploitation. The target repository (jackson-databind 2.19.0-tuxcare.3) contains the upstream fix commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta, which adds these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release that TuxCare onboarded (commit 3cbdd8b52b \"Onboard version 2.19.0\"), not a TuxCare backport. The denylist is enforced by default during type resolution via validateSubType(), blocking instantiation of these gadget classes and preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:46:28.565161+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not a vulnerability in jackson-databind 2.19.0-tuxcare.3. The fix for this CVE (adding org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource to the deserialization blocklist) was already included in the upstream jackson-databind 2.19.0 release. The vulnerable gadget class is blocked at SubTypeValidator.java:230, preventing exploitation. This is an upstream fix by Tatu Saloranta (commit 3e8fa3be) that shipped with the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is not a vulnerability in jackson-databind 2.19.0-tuxcare.3. The fix for this CVE (adding org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource to the deserialization blocklist) was already included in the upstream jackson-databind 2.19.0 release. The vulnerable gadget class is blocked at SubTypeValidator.java:230, preventing exploitation. This is an upstream fix by Tatu Saloranta (commit 3e8fa3be) that shipped with the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:51:34.970346+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.19.0-tuxcare.3. The fix that blocks deserialization of the dangerous classes `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource` and `com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource` was applied by upstream author Tatu Saloranta in commit 33d96c13fe1 (December 2020) and was already included in the upstream 2.19.0 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.19.0-tuxcare.3. The fix that blocks deserialization of the dangerous classes `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource` and `com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource` was applied by upstream author Tatu Saloranta in commit 33d96c13fe1 (December 2020) and was already included in the upstream 2.19.0 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.19.0. The vulnerability involves unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource gadget class. The upstream fix (commit 33d96c13, authored by tatu.saloranta@iki.fi) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release when TuxCare onboarded it (first TuxCare commit 3cbdd8b5). The blocklist entries at lines 223-224 prevent instantiation of the dangerous classes during polymorphic deserialization, blocking the attack chain before code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.19.0. The vulnerability involves unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource gadget class. The upstream fix (commit 33d96c13, authored by tatu.saloranta@iki.fi) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.0 release when TuxCare onboarded it (first TuxCare commit 3cbdd8b5). The blocklist entries at lines 223-224 prevent instantiation of the dangerous classes during polymorphic deserialization, blocking the attack chain before code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:16:13.721778+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 affects jackson-databind versions that use recursive deserialization of deeply nested JSON, causing stack overflow. Target version 2.19.0 is not affected because it includes the upstream fix (commit 8238ab41d0) that re-implemented UntypedObjectDeserializer using a non-recursive approach (UntypedObjectDeserializerNR). This fix was shipped in the upstream release 2.14 and carried forward to 2.19.0 when TuxCare onboarded it. The vulnerable recursive pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 affects jackson-databind versions that use recursive deserialization of deeply nested JSON, causing stack overflow. Target version 2.19.0 is not affected because it includes the upstream fix (commit 8238ab41d0) that re-implemented UntypedObjectDeserializer using a non-recursive approach (UntypedObjectDeserializerNR). This fix was shipped in the upstream release 2.14 and carried forward to 2.19.0 when TuxCare onboarded it. The vulnerable recursive pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:47.660203+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target repository (version 2.19.0-tuxcare.3) already contains the upstream fix from commit 914e7c9f2cb (Feb 2020) which adds JndiConverter to the SubTypeValidator blocklist. This fix was shipped in the upstream version 2.19.0 release, predating TuxCare's onboarding by over 6 years. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target repository (version 2.19.0-tuxcare.3) already contains the upstream fix from commit 914e7c9f2cb (Feb 2020) which adds JndiConverter to the SubTypeValidator blocklist. This fix was shipped in the upstream version 2.19.0 release, predating TuxCare's onboarding by over 6 years. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.19.0-tuxcare.3) is NOT vulnerable to CVE-2020-9546. The vulnerability involves deserialization gadgets using org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix\u2014adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java\u2014is already present at line 141. This fix was authored by upstream developer Tatu Saloranta (commit 9f4e97019fb, 2020-02-29) and shipped in the upstream 2.19.0 release before TuxCare onboarding (first TuxCare commit: 3cbdd8b52b). This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target repository (jackson-databind 2.19.0-tuxcare.3) is NOT vulnerable to CVE-2020-9546. The vulnerability involves deserialization gadgets using org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix\u2014adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java\u2014is already present at line 141. This fix was authored by upstream developer Tatu Saloranta (commit 9f4e97019fb, 2020-02-29) and shipped in the upstream 2.19.0 release before TuxCare onboarding (first TuxCare commit: 3cbdd8b52b). This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:42:13.542842+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entry for the deserialization gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target repository (jackson-databind 2.19.0-tuxcare.3) already contains the upstream fix that adds this class to the blocklist in SubTypeValidator.java at line 144. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1e64db6a2f and was included in upstream releases starting from version 2.10.4. This fix was already present in the upstream release before TuxCare began maintaining this version branch. Therefore, the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to missing blocklist entry for the deserialization gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The target repository (jackson-databind 2.19.0-tuxcare.3) already contains the upstream fix that adds this class to the blocklist in SubTypeValidator.java at line 144. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 1e64db6a2f and was included in upstream releases starting from version 2.10.4. This fix was already present in the upstream release before TuxCare began maintaining this version branch. Therefore, the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:16:13.062310+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves deserializing the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPConfig, which can lead to arbitrary code execution. The upstream fix (commits 9f4e97019f and 1e64db6a2f) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already included in upstream release 2.19.0 before TuxCare onboarded it (first TuxCare commit: 3cbdd8b52b \"Onboard version 2.19.0\"). The target contains the blocklist entry at SubTypeValidator.java:145, and the validateSubType method is called during deserialization via BeanDeserializerFactory, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability involves deserializing the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPConfig, which can lead to arbitrary code execution. The upstream fix (commits 9f4e97019f and 1e64db6a2f) added this class to the deserialization blocklist in SubTypeValidator.java. This fix was already included in upstream release 2.19.0 before TuxCare onboarded it (first TuxCare commit: 3cbdd8b52b \"Onboard version 2.19.0\"). The target contains the blocklist entry at SubTypeValidator.java:145, and the validateSubType method is called during deserialization via BeanDeserializerFactory, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:14:37.389349+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.19.0. The vulnerability involved missing blacklist entries for dangerous gadget classes (specifically javax.swing.JTextPane and others) that could be exploited for arbitrary code execution through polymorphic deserialization. The fix was implemented by upstream maintainer Tatu Saloranta in commit 7dbf51bf78 on September 17, 2020, and shipped in jackson-databind 2.9.10.7. Since the target version 2.19.0 is significantly newer than 2.9.10.7, it inherited this fix from the upstream release when TuxCare onboarded version 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.19.0. The vulnerability involved missing blacklist entries for dangerous gadget classes (specifically javax.swing.JTextPane and others) that could be exploited for arbitrary code execution through polymorphic deserialization. The fix was implemented by upstream maintainer Tatu Saloranta in commit 7dbf51bf78 on September 17, 2020, and shipped in jackson-databind 2.9.10.7. Since the target version 2.19.0 is significantly newer than 2.9.10.7, it inherited this fix from the upstream release when TuxCare onboarded version 2.19.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is not present in jackson-databind 2.19.0. The vulnerability involved unsafe memory allocation in NodeSerialization.readExternal() which would allocate byte arrays based on untrusted length values from JDK serialization streams, potentially causing 2GB heap usage. The upstream fix (commit 3ccde7d938) implemented chunked reading with a 100k eager allocation limit, and this fix was already present in the upstream jackson-databind 2.19.0 release that TuxCare onboarded. The target contains the complete mitigation including the LONGEST_EAGER_ALLOC constant and _read() method with ByteArrayBuilder-based chunked reading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 is not present in jackson-databind 2.19.0. The vulnerability involved unsafe memory allocation in NodeSerialization.readExternal() which would allocate byte arrays based on untrusted length values from JDK serialization streams, potentially causing 2GB heap usage. The upstream fix (commit 3ccde7d938) implemented chunked reading with a 100k eager allocation limit, and this fix was already present in the upstream jackson-databind 2.19.0 release that TuxCare onboarded. The target contains the complete mitigation including the LONGEST_EAGER_ALLOC constant and _read() method with ByteArrayBuilder-based chunked reading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:45:07.357611+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability (resource exhaustion via deep array nesting with UNWRAP_SINGLE_VALUE_ARRAYS) was fixed in upstream version 2.14.0 by commit d78d00ee7b. The target version 2.19.0 already contains this fix as it was shipped in the upstream release that TuxCare onboarded. The defense code is confirmed present in both StdDeserializer.java (handleNestedArrayForSingle method) and BeanDeserializer.java (nested array detection), preventing deeply-nested array attacks by rejecting second consecutive START_ARRAY tokens.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 is NOT present in jackson-databind 2.19.0-tuxcare.3. The vulnerability (resource exhaustion via deep array nesting with UNWRAP_SINGLE_VALUE_ARRAYS) was fixed in upstream version 2.14.0 by commit d78d00ee7b. The target version 2.19.0 already contains this fix as it was shipped in the upstream release that TuxCare onboarded. The defense code is confirmed present in both StdDeserializer.java (handleNestedArrayForSingle method) and BeanDeserializer.java (nested array detection), preventing deeply-nested array attacks by rejecting second consecutive START_ARRAY tokens.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:58:07.747368+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.19.0. The vulnerability requires deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled to cause resource exhaustion. The upstream vendor (FasterXML) fixed this in commit 063183589218fec19a9293ed2f17ec53ea80ba88 (authored by Tatu Saloranta on 2022-08-23) by adding checks in BeanDeserializer._deserializeFromArray and StdDeserializer to reject nested START_ARRAY tokens. This fix was already present in the upstream release when TuxCare onboarded version 2.19.0 (first TuxCare commit 3cbdd8b52b on 2026-10-28). The defense code is present at BeanDeserializer.java:655-661 and StdDeserializer.java:2269-2276.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.19.0. The vulnerability requires deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled to cause resource exhaustion. The upstream vendor (FasterXML) fixed this in commit 063183589218fec19a9293ed2f17ec53ea80ba88 (authored by Tatu Saloranta on 2022-08-23) by adding checks in BeanDeserializer._deserializeFromArray and StdDeserializer to reject nested START_ARRAY tokens. This fix was already present in the upstream release when TuxCare onboarded version 2.19.0 (first TuxCare commit 3cbdd8b52b on 2026-10-28). The defense code is present at BeanDeserializer.java:655-661 and StdDeserializer.java:2269-2276.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:19:00.068472+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2026-50193. The vulnerability (stack overflow via recursive serialization of deeply nested JSON in JsonNode.toString()) was fixed in upstream commit a1fa4ae4ec by replacing recursive traversal with iterative traversal using an IteratorStack. This fix was already present in the upstream 2.19.0 release before TuxCare onboarded it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.19.0-tuxcare.3 is not affected by CVE-2026-50193. The vulnerability (stack overflow via recursive serialization of deeply nested JSON in JsonNode.toString()) was fixed in upstream commit a1fa4ae4ec by replacing recursive traversal with iterative traversal using an IteratorStack. This fix was already present in the upstream 2.19.0 release before TuxCare onboarded it..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T02:36:00.140016+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.19.0 is not affected by CVE-2026-54517. While the vulnerable code pattern (missing @JsonView checks in property buffering paths) exists in BeanDeserializer, the attack chain is broken because the trigger mechanism identified in the CVE does not exist in this version. The CVE states the vulnerability was introduced by \"A change making SetterlessProperty.isMerging() return true\" which r...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.19.0 is not affected by CVE-2026-54517. While the vulnerable code pattern (missing @JsonView checks in property buffering paths) exists in BeanDeserializer, the attack chain is broken because the trigger mechanism identified in the CVE does not exist in this version. The CVE states the vulnerability was introduced by \"A change making SetterlessProperty.isMerging() return true\" which r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "action_statement": "Vulnerability CVE-2026-54518 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:48:56.624496+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.19.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.19.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T13:59:00.500640+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.19.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.19.0-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.19.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.19.0-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}