{
  "@id": "urn:uuid:12b27963-d785-44bf-8c54-21a96b047c3e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 65,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:23:21.346897+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability concerns dangerous classes that can be exploited via polymorphic deserialization to achieve arbitrary code execution. The fix adds these classes to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) that prevents their deserialization. In the target, this blacklist is present in SubTypeValidator.java (lines 45-48 for the specific classes from issues #1737 and #1680) and actively enforced via SubTypeValidator.validateSubType(). The fixes were authored by upstream maintainer Tatu Saloranta and were already present in the upstream jackson-databind 2.19.4 release before TuxCare onboarded it (first TuxCare commit d3dea6694a \"Onboard version 2.19.4\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability concerns dangerous classes that can be exploited via polymorphic deserialization to achieve arbitrary code execution. The fix adds these classes to a blacklist (DEFAULT_NO_DESER_CLASS_NAMES) that prevents their deserialization. In the target, this blacklist is present in SubTypeValidator.java (lines 45-48 for the specific classes from issues #1737 and #1680) and actively enforced via SubTypeValidator.validateSubType(). The fixes were authored by upstream maintainer Tatu Saloranta and were already present in the upstream jackson-databind 2.19.4 release before TuxCare onboarded it (first TuxCare commit d3dea6694a \"Onboard version 2.19.4\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.4 is not affected by CVE-2017-17485. The vulnerability concerned jackson-databind versions through 2.8.10 and 2.9.x through 2.9.3, where unsafe deserialization could lead to remote code execution when Spring libraries were in the classpath. The upstream vendor (FasterXML) fixed this in version 2.8.11 by introducing SubTypeValidator with a comprehensive blacklist of dangerous classes (including Spring framework gadget classes). This fix was already present in the upstream jackson-databind 2.19.4 release that TuxCare onboarded, confirmed by git ancestry analysis showing fix commit 2235894210 predates the first TuxCare commit d3dea6694a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target version 2.19.4 is not affected by CVE-2017-17485. The vulnerability concerned jackson-databind versions through 2.8.10 and 2.9.x through 2.9.3, where unsafe deserialization could lead to remote code execution when Spring libraries were in the classpath. The upstream vendor (FasterXML) fixed this in version 2.8.11 by introducing SubTypeValidator with a comprehensive blacklist of dangerous classes (including Spring framework gadget classes). This fix was already present in the upstream jackson-databind 2.19.4 release that TuxCare onboarded, confirmed by git ancestry analysis showing fix commit 2235894210 predates the first TuxCare commit d3dea6694a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:26.936701+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.19.4-tuxcare.2. The fix for this deserialization vulnerability was already included in the upstream release 2.19.4. The SubTypeValidator class contains a comprehensive blocklist (DEFAULT_NO_DESER_CLASS_NAMES) that includes the dangerous classes mentioned in the CVE (TemplatesImpl variants), and this validation is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.19.4-tuxcare.2. The fix for this deserialization vulnerability was already included in the upstream release 2.19.4. The SubTypeValidator class contains a comprehensive blocklist (DEFAULT_NO_DESER_CLASS_NAMES) that includes the dangerous classes mentioned in the CVE (TemplatesImpl variants), and this validation is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:24:51.671524+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability was fixed in the upstream release through blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator. The fix was authored by upstream maintainer Tatu Saloranta in May 2018 (commit 27b4defc27) and was already present in the upstream 2.19.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability was fixed in the upstream release through blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator. The fix was authored by upstream maintainer Tatu Saloranta in May 2018 (commit 27b4defc27) and was already present in the upstream 2.19.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.19.4. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.19.4 is significantly newer and already contains the upstream fix (commit 28badf7ef6) that blocklists the three dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. This fix was shipped in the upstream 2.19.4 release that TuxCare onboarded (commit d3dea6694a \"Onboard version 2.19.4\"), making it an upstream-provided defense rather than a TuxCare backport. The SubTypeValidator actively blocks deserialization of these gadget classes during bean deserialization (invoked at BeanDeserializerFactory.java:1104).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.19.4. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.19.4 is significantly newer and already contains the upstream fix (commit 28badf7ef6) that blocklists the three dangerous classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in SubTypeValidator.java. This fix was shipped in the upstream 2.19.4 release that TuxCare onboarded (commit d3dea6694a \"Onboard version 2.19.4\"), making it an upstream-provided defense rather than a TuxCare backport. The SubTypeValidator actively blocks deserialization of these gadget classes during bean deserialization (invoked at BeanDeserializerFactory.java:1104).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.4 is not affected by CVE-2018-12023. The vulnerability required the absence of blacklist entries for Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that could trigger JNDI/LDAP lookups during polymorphic deserialization. These blacklist entries are present in SubTypeValidator.java (lines 70-72) and were included in the upstream 2.19.4 release. The fix was originally added by upstream maintainer Tatu Saloranta in commit 28badf7ef6 (June 2018) for version 2.7.9.4, well before the 2.19.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "Target jackson-databind 2.19.4 is not affected by CVE-2018-12023. The vulnerability required the absence of blacklist entries for Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that could trigger JNDI/LDAP lookups during polymorphic deserialization. These blacklist entries are present in SubTypeValidator.java (lines 70-72) and were included in the upstream 2.19.4 release. The fix was originally added by upstream maintainer Tatu Saloranta in commit 28badf7ef6 (June 2018) for version 2.7.9.4, well before the 2.19.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:29.897304+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.4 is NOT affected by CVE-2018-14718. The fix that blacklists org.slf4j.ext.EventData and three other dangerous classes from polymorphic deserialization is present in SubTypeValidator.java (lines 75-78). This fix originated from upstream commit 87d29af25e by maintainer Tatu Saloranta and was already part of the upstream 2.19.4 release before TuxCare onboarded it. The blacklist is actively enforced via BeanDeserializerFactory calling SubTypeValidator.instance().validateSubType(), preventing deserialization of these classes with the error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target jackson-databind 2.19.4 is NOT affected by CVE-2018-14718. The fix that blacklists org.slf4j.ext.EventData and three other dangerous classes from polymorphic deserialization is present in SubTypeValidator.java (lines 75-78). This fix originated from upstream commit 87d29af25e by maintainer Tatu Saloranta and was already part of the upstream 2.19.4 release before TuxCare onboarded it. The blacklist is actively enforced via BeanDeserializerFactory calling SubTypeValidator.instance().validateSubType(), preventing deserialization of these classes with the error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:04:33.761797+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.19.4. The vulnerability concerns missing blacklist entries for blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related gadget classes) in polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (Aug 2018) by adding these classes to SubTypeValidator's blacklist. This fix was already present in the upstream version 2.19.4 before TuxCare onboarded it (onboarding commit d3dea6694a by evasilev@cloudlinux.com). The target repository contains the complete fix in SubTypeValidator.java lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.19.4. The vulnerability concerns missing blacklist entries for blaze-ds classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related gadget classes) in polymorphic deserialization. The upstream vendor (FasterXML) fixed this in commit 87d29af25e82a249ea15858e2d4ecbf64091db44 (Aug 2018) by adding these classes to SubTypeValidator's blacklist. This fix was already present in the upstream version 2.19.4 before TuxCare onboarded it (onboarding commit d3dea6694a by evasilev@cloudlinux.com). The target repository contains the complete fix in SubTypeValidator.java lines 74-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:11:01.674474+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involved four dangerous classes that could be exploited via polymorphic deserialization to conduct XXE attacks. The upstream fix (commit 87d29af25e) added these four classes to the deserialization blacklist in SubTypeValidator.java, and this fix was already included in upstream release 2.19.4 before TuxCare onboarded it. The blacklist entries at lines 75-78 block: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The validation is enforced on all deserialization paths via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involved four dangerous classes that could be exploited via polymorphic deserialization to conduct XXE attacks. The upstream fix (commit 87d29af25e) added these four classes to the deserialization blacklist in SubTypeValidator.java, and this fix was already included in upstream release 2.19.4 before TuxCare onboarded it. The blacklist entries at lines 75-78 block: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. The validation is enforced on all deserialization paths via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:54.716958+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind 2.x before 2.9.7 by allowing SSRF attacks through polymorphic deserialization of the axis2-jaxws class. The target version 2.19.4-tuxcare.2 already contains the upstream fix (commit 87d29af25e by Tatu Saloranta, Aug 2018) that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from deserialization. This fix was present in the upstream 2.19.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind 2.x before 2.9.7 by allowing SSRF attacks through polymorphic deserialization of the axis2-jaxws class. The target version 2.19.4-tuxcare.2 already contains the upstream fix (commit 87d29af25e by Tatu Saloranta, Aug 2018) that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from deserialization. This fix was present in the upstream 2.19.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blacklist entries for org.apache.axis2.transport.jms.JMSOutTransportInfo and related gadget classes in polymorphic deserialization. The target (jackson-databind 2.19.4-tuxcare.1) contains the upstream fix commit 72cd4025a229fb28ec133235003dd4616f70afaa authored by Tatu Saloranta, which added all four CVE-2018-19360 gadget classes to the SubTypeValidator blacklist. This fix was already present in the upstream jackson-databind 2.19.4 release that TuxCare onboarded (commit d3dea6694a98dbe1ac2dc0f0eb1d086fde4c2abb). The blacklist is enforced by default during bean deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blacklist entries for org.apache.axis2.transport.jms.JMSOutTransportInfo and related gadget classes in polymorphic deserialization. The target (jackson-databind 2.19.4-tuxcare.1) contains the upstream fix commit 72cd4025a229fb28ec133235003dd4616f70afaa authored by Tatu Saloranta, which added all four CVE-2018-19360 gadget classes to the SubTypeValidator blacklist. This fix was already present in the upstream jackson-databind 2.19.4 release that TuxCare onboarded (commit d3dea6694a98dbe1ac2dc0f0eb1d086fde4c2abb). The blacklist is enforced by default during bean deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:25.795966+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves polymorphic deserialization of org.apache.openjpa.ee classes (RegistryManagedRuntime and JNDIManagedRuntime). The fix, which adds these classes to a blocklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.19.4 release that TuxCare onboarded. The blocklist is enforced during bean deserialization via SubTypeValidator.validateSubType(), preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves polymorphic deserialization of org.apache.openjpa.ee classes (RegistryManagedRuntime and JNDIManagedRuntime). The fix, which adds these classes to a blocklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.19.4 release that TuxCare onboarded. The blocklist is enforced during bean deserialization via SubTypeValidator.validateSubType(), preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:54.426721+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is not affecting this target. The fix blocking org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization was already present in the upstream jackson-databind 2.19.4 release (commit 72cd4025a22 by Tatu Saloranta, Nov 2018) before TuxCare onboarded the version. The blocklist entry exists in SubTypeValidator.java line 81 and is enforced during deserialization via BeanDeserializerFactory.java line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is not affecting this target. The fix blocking org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization was already present in the upstream jackson-databind 2.19.4 release (commit 72cd4025a22 by Tatu Saloranta, Nov 2018) before TuxCare onboarded the version. The blocklist entry exists in SubTypeValidator.java line 81 and is enforced during deserialization via BeanDeserializerFactory.java line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.19.4. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the deserialization blacklist to achieve remote code execution. The upstream vendor (FasterXML) fixed this in commit 038b471e2e by adding these classes to the blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.19.4. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the deserialization blacklist to achieve remote code execution. The upstream vendor (FasterXML) fixed this in commit 038b471e2e by adding these classes to the blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:43.517878+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability, which allowed unauthenticated remote code execution via malicious JSON payloads referencing c3p0 library classes, was fixed in upstream commit 6799f8f10cc (Feb 2018) by Tatu Saloranta. This fix was included in upstream release 2.9.5 and all subsequent versions. The target version 2.19.4 (onboarded by TuxCare from the upstream release) includes the complete fix: SubTypeValidator.java lines 288-298 implement a prefix-based check that blocks all c3p0 classes matching \"com.mchange.v2.c3p0.*DataSource\" from being deserialized, preventing the exploitation chain described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability, which allowed unauthenticated remote code execution via malicious JSON payloads referencing c3p0 library classes, was fixed in upstream commit 6799f8f10cc (Feb 2018) by Tatu Saloranta. This fix was included in upstream release 2.9.5 and all subsequent versions. The target version 2.19.4 (onboarded by TuxCare from the upstream release) includes the complete fix: SubTypeValidator.java lines 288-298 implement a prefix-based check that blocks all c3p0 classes matching \"com.mchange.v2.c3p0.*DataSource\" from being deserialized, preventing the exploitation chain described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:37:30.400386+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.19.4-tuxcare.2 is not affected by CVE-2019-12086. The upstream fix blocking com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization was already present in the upstream release 2.19.4 that TuxCare onboarded. The fix commit (dda513bd72) by upstream maintainer Tatu Saloranta predates the first TuxCare commit (d3dea6694a - onboarding of version 2.19.4), confirming this is an upstream fix shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target jackson-databind version 2.19.4-tuxcare.2 is not affected by CVE-2019-12086. The upstream fix blocking com.mysql.cj.jdbc.admin.MiniAdmin from polymorphic deserialization was already present in the upstream release 2.19.4 that TuxCare onboarded. The fix commit (dda513bd72) by upstream maintainer Tatu Saloranta predates the first TuxCare commit (d3dea6694a - onboarding of version 2.19.4), confirming this is an upstream fix shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T18:50:00.189395+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.19.4-tuxcare.2 is NOT affected by CVE-2019-12384. The vulnerability concerned polymorphic deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource which could lead to RCE. The fix (adding this class to the SubTypeValidator blocklist) was shipped in upstream version 2.9.9.1 and is present in the target at SubTypeValidator.java:91. Since the ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind version 2.19.4-tuxcare.2 is NOT affected by CVE-2019-12384. The vulnerability concerned polymorphic deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource which could lead to RCE. The fix (adding this class to the SubTypeValidator blocklist) was shipped in upstream version 2.9.9.1 and is present in the target at SubTypeValidator.java:91. Since the ta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T07:30:00.106983+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes leading to arbitrary file read. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the SubTypeValidator blocklist. This fix was already present in upstream re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes leading to arbitrary file read. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the SubTypeValidator blocklist. This fix was already present in upstream re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind version 2.19.4-tuxcare.1) is NOT AFFECTED by CVE-2019-14379. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled, leading to remote code execution. The fix (blocklist entries for DefaultTransactionManagerLookup and JNDIConnectionSource) was authored by upstream maintainer Tatu Saloranta in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b and shipped in the upstream 2.19.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the blocklist prevents deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target repository (jackson-databind version 2.19.4-tuxcare.1) is NOT AFFECTED by CVE-2019-14379. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled, leading to remote code execution. The fix (blocklist entries for DefaultTransactionManagerLookup and JNDIConnectionSource) was authored by upstream maintainer Tatu Saloranta in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b and shipped in the upstream 2.19.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the blocklist prevents deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:35.987953+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.4 is not affected by CVE-2019-14439. The upstream fix (blacklisting ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator) was already present in the upstream release 2.19.4 when TuxCare onboarded it. The vulnerable code pattern that allowed deserialization of the dangerous logback JNDI class has been removed by commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b authored by upstream maintainer Tatu Saloranta. Target version 2.19.4 is significantly newer than all affected versions listed in the CVE (< 2.9.9.2, 2.8.11.4, 2.7.9.6, 2.6.7.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "The target jackson-databind 2.19.4 is not affected by CVE-2019-14439. The upstream fix (blacklisting ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator) was already present in the upstream release 2.19.4 when TuxCare onboarded it. The vulnerable code pattern that allowed deserialization of the dangerous logback JNDI class has been removed by commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b authored by upstream maintainer Tatu Saloranta. Target version 2.19.4 is significantly newer than all affected versions listed in the CVE (< 2.9.9.2, 2.8.11.4, 2.7.9.6, 2.6.7.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:51:09.392901+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.19.4. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which could lead to remote code execution. The fix (blocklist entries preventing deserialization of these classes) was already present in the upstream Jackson 2.19.4 release that TuxCare onboarded. The SubTypeValidator class contains the necessary blocklist entries at lines 105 and 107, and actively enforces them during deserialization via the validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.19.4. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which could lead to remote code execution. The fix (blocklist entries preventing deserialization of these classes) was already present in the upstream Jackson 2.19.4 release that TuxCare onboarded. The SubTypeValidator class contains the necessary blocklist entries at lines 105 and 107, and actively enforces them during deserialization via the validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:11.316675+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.19.4-tuxcare.2 is NOT vulnerable to CVE-2019-14892. The fix was already present in the upstream 2.19.4 release that TuxCare onboarded (commit 41b7f9b901 authored by tatu.saloranta@iki.fi). The SubTypeValidator.java file contains the required blocklist entries at lines 113-114 that prevent polymorphic deserialization of \"org.apache.commons.configuration.JNDIConfiguration\" and \"org.apache.commons.configuration2.JNDIConfiguration\", blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "The target repository jackson-databind 2.19.4-tuxcare.2 is NOT vulnerable to CVE-2019-14892. The fix was already present in the upstream 2.19.4 release that TuxCare onboarded (commit 41b7f9b901 authored by tatu.saloranta@iki.fi). The SubTypeValidator.java file contains the required blocklist entries at lines 113-114 that prevent polymorphic deserialization of \"org.apache.commons.configuration.JNDIConfiguration\" and \"org.apache.commons.configuration2.JNDIConfiguration\", blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involved missing blacklist entry for org.apache.xalan.lib.sql.JNDIConnectionPool gadget class, allowing arbitrary code execution via JNDI injection during polymorphic deserialization. The fix (adding the class to DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java line 117) was already present in upstream version 2.19.4 when TuxCare onboarded it. Fix commit 998efd708284778f29d83d7962a9bd935c228317 by upstream author tatu.saloranta@iki.fi shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involved missing blacklist entry for org.apache.xalan.lib.sql.JNDIConnectionPool gadget class, allowing arbitrary code execution via JNDI injection during polymorphic deserialization. The fix (adding the class to DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java line 117) was already present in upstream version 2.19.4 when TuxCare onboarded it. Fix commit 998efd708284778f29d83d7962a9bd935c228317 by upstream author tatu.saloranta@iki.fi shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:41.975072+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 (polymorphic typing vulnerability with HikariDataSource) is not present in jackson-databind 2.19.4. The upstream fix that blacklists com.zaxxer.hikari.HikariDataSource was already included in the upstream release 2.10.0 (September 2019), which predates version 2.19.4. The fix commit 73c1c2cc76 by upstream author Tatu Saloranta added the HikariDataSource entry to SubTypeValidator's blacklist, preventing malicious deserialization of this gadget class. This protection is active in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 (polymorphic typing vulnerability with HikariDataSource) is not present in jackson-databind 2.19.4. The upstream fix that blacklists com.zaxxer.hikari.HikariDataSource was already included in the upstream release 2.10.0 (September 2019), which predates version 2.19.4. The fix commit 73c1c2cc76 by upstream author Tatu Saloranta added the HikariDataSource entry to SubTypeValidator's blacklist, preventing malicious deserialization of this gadget class. This protection is active in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:01.936733+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability affects versions 2.0.0 through 2.9.10 and involves unsafe deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commits 9593e16 and 328a0f8 by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The target version 2.19.4 already contains this upstream fix at lines 124-125 of SubTypeValidator.java, which was shipped in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability affects versions 2.0.0 through 2.9.10 and involves unsafe deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in commits 9593e16 and 328a0f8 by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The target version 2.19.4 already contains this upstream fix at lines 124-125 of SubTypeValidator.java, which was shipped in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:20:54.241430+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerable class com.p6spy.engine.spy.P6DataSource is blocked in SubTypeValidator.java (line 127), preventing polymorphic deserialization exploitation. This fix was shipped in upstream release 2.19.4, authored by Tatu Saloranta (upstream maintainer), before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerable class com.p6spy.engine.spy.P6DataSource is blocked in SubTypeValidator.java (line 127), preventing polymorphic deserialization exploitation. This fix was shipped in upstream release 2.19.4, authored by Tatu Saloranta (upstream maintainer), before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.19.4-tuxcare.2) is not affected by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which could allow arbitrary code execution. However, this class is already blocked in the target's SubTypeValidator.java at line 99, preventing it from being deserialized. The fix was authored by the upstream vendor (Tatu Saloranta, tatu.saloranta@iki.fi) in commit 191a4cdf87 and was already present in the upstream release 2.19.4 when TuxCare onboarded it (first TuxCare commit d3dea6694a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target repository (jackson-databind 2.19.4-tuxcare.2) is not affected by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup, which could allow arbitrary code execution. However, this class is already blocked in the target's SubTypeValidator.java at line 99, preventing it from being deserialized. The fix was authored by the upstream vendor (Tatu Saloranta, tatu.saloranta@iki.fi) in commit 191a4cdf87 and was already present in the upstream release 2.19.4 when TuxCare onboarded it (first TuxCare commit d3dea6694a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:50:46.310411+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and apache-log4j-extras (1.2.x) is in the classpath, allowing arbitrary code execution via JNDI injection. The fix blacklists two log4j-extras classes (DriverManagerConnectionSource, JNDIConnectionSource). The target repository jackson-databind 2.19.4-tuxcare.2 already contains this fix at SubTypeValidator.java lines 129-131. The fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 (October 2019) and was included in the upstream release 2.19.4 that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind's polymorphic deserialization when Default Typing is enabled and apache-log4j-extras (1.2.x) is in the classpath, allowing arbitrary code execution via JNDI injection. The fix blacklists two log4j-extras classes (DriverManagerConnectionSource, JNDIConnectionSource). The target repository jackson-databind 2.19.4-tuxcare.2 already contains this fix at SubTypeValidator.java lines 129-131. The fix was authored by upstream FasterXML maintainer Tatu Saloranta in commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 (October 2019) and was included in the upstream release 2.19.4 that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.19.4. The vulnerability required blocking two ehcache gadget classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The upstream fix (commit fc4214a883 by Tatu Saloranta) was already included in version 2.19.4 when TuxCare onboarded it. Lines 133-135 of SubTypeValidator.java contain the required blocklist entries, and the validation logic at lines 269-303 actively prevents deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.19.4. The vulnerability required blocking two ehcache gadget classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The upstream fix (commit fc4214a883 by Tatu Saloranta) was already included in version 2.19.4 when TuxCare onboarded it. Lines 133-135 of SubTypeValidator.java contain the required blocklist entries, and the validation logic at lines 269-303 actively prevents deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:08:31.778572+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.19.4-tuxcare.2) contains the upstream fix for CVE-2020-10650. The fix (commit a424c038ba) adds three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was shipped in the upstream 2.19.4 release before TuxCare's onboarding (first TuxCare commit: d3dea6694a). The blocklist prevents deserialization of these classes, blocking the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind 2.19.4-tuxcare.2) contains the upstream fix for CVE-2020-10650. The fix (commit a424c038ba) adds three dangerous classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was shipped in the upstream 2.19.4 release before TuxCare's onboarding (first TuxCare commit: d3dea6694a). The blocklist prevents deserialization of these classes, blocking the attack chain from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of dangerous gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory) that can enable remote code execution. The fix, which adds these classes to the deserialization blocklist in SubTypeValidator.java, was applied by upstream maintainer Tatu Saloranta in commit 592872f423 (March 2020) as part of jackson-databind 2.9.10.4. This fix was already present in the upstream release 2.19.4 that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of dangerous gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and RecoverablePooledConnectionFactory) that can enable remote code execution. The fix, which adds these classes to the deserialization blocklist in SubTypeValidator.java, was applied by upstream maintainer Tatu Saloranta in commit 592872f423 (March 2020) as part of jackson-databind 2.9.10.4. This fix was already present in the upstream release 2.19.4 that TuxCare onboarded, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:33:25.157477+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.19.4-tuxcare.2. The fix blocking deserialization of com.caucho.config.types.ResourceRef was already included in the upstream 2.19.4 release that TuxCare onboarded. The vulnerable gadget class is blocked at line 167 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.19.4-tuxcare.2. The fix blocking deserialization of com.caucho.config.types.ResourceRef was already included in the upstream 2.19.4 release that TuxCare onboarded. The vulnerable gadget class is blocked at line 167 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider. The target version 2.19.4 already contains the upstream fix from commit 05d7e0e13f (March 2020) which added RmiProvider to the deserialization blocklist in SubTypeValidator.java. This fix was included in the upstream 2.19.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider. The target version 2.19.4 already contains the upstream fix from commit 05d7e0e13f (March 2020) which added RmiProvider to the deserialization blocklist in SubTypeValidator.java. This fix was included in the upstream 2.19.4 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability involving javax.swing.JEditorPane. The target version 2.19.4 is NOT vulnerable because the fix was already applied by upstream maintainer Tatu Saloranta in March 2020 (commit 4d038c9de0a) and shipped with the upstream release. The fix adds \"javax.swing.JEditorPane\" to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing deserialization of this gadget class. This protection has been present in the codebase since 2020, well before version 2.19.4 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability involving javax.swing.JEditorPane. The target version 2.19.4 is NOT vulnerable because the fix was already applied by upstream maintainer Tatu Saloranta in March 2020 (commit 4d038c9de0a) and shipped with the upstream release. The fix adds \"javax.swing.JEditorPane\" to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing deserialization of this gadget class. This protection has been present in the codebase since 2020, well before version 2.19.4 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.19.4-tuxcare.2) is NOT affected by CVE-2020-11111. The vulnerability pattern has been eliminated by upstream fixes that were already present in the upstream release 2.19.4 when TuxCare onboarded it. The SubTypeValidator.java file contains the complete activemq deserialization blocklist (lines 173-183) that prevents the exploitation described in CVE-2020-11111. The fix was authored by the upstream vendor (tatu.saloranta@iki.fi) in commits c14c9f99ed and 05d7e0e13f, both of which are ancestors of the first TuxCare onboarding commit (d3dea6694a by evasilev@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target repository (jackson-databind 2.19.4-tuxcare.2) is NOT affected by CVE-2020-11111. The vulnerability pattern has been eliminated by upstream fixes that were already present in the upstream release 2.19.4 when TuxCare onboarded it. The SubTypeValidator.java file contains the complete activemq deserialization blocklist (lines 173-183) that prevents the exploitation described in CVE-2020-11111. The fix was authored by the upstream vendor (tatu.saloranta@iki.fi) in commits c14c9f99ed and 05d7e0e13f, both of which are ancestors of the first TuxCare onboarding commit (d3dea6694a by evasilev@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in jackson-databind 2.19.4. The vulnerability involves unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider class. The target contains the upstream fix (commit 08fbfacf89) which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 186). This blacklist is enforced by the validateSubType method and is active by default. The fix was shipped in the upstream 2.19.4 release that TuxCare onboarded, prior to any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is not present in jackson-databind 2.19.4. The vulnerability involves unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider class. The target contains the upstream fix (commit 08fbfacf89) which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 186). This blacklist is enforced by the validateSubType method and is active by default. The fix was shipped in the upstream 2.19.4 release that TuxCare onboarded, prior to any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime leading to arbitrary code execution. The target contains the upstream fix at SubTypeValidator.java line 84, which blocks this class from being deserialized. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit e2ba12d5d60715d95105e3e790fc234cfb59893d and was already present in the upstream release 2.19.4 that TuxCare onboarded, before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime leading to arbitrary code execution. The target contains the upstream fix at SubTypeValidator.java line 84, which blocks this class from being deserialized. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit e2ba12d5d60715d95105e3e790fc234cfb59893d and was already present in the upstream release 2.19.4 that TuxCare onboarded, before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.4-tuxcare.2 is NOT AFFECTED by CVE-2020-11619. The vulnerability concerns deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. These classes are already present in the SubTypeValidator deny list (lines 53-54), blocking their deserialization. The fix (commit 113e89fb08) was shipped in upstream jackson-databind 2.19.4 before TuxCare onboarded it, authored by Tatu Saloranta (upstream maintainer, not TuxCare).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target jackson-databind 2.19.4-tuxcare.2 is NOT AFFECTED by CVE-2020-11619. The vulnerability concerns deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. These classes are already present in the SubTypeValidator deny list (lines 53-54), blocking their deserialization. The fix (commit 113e89fb08) was shipped in upstream jackson-databind 2.19.4 before TuxCare onboarded it, authored by Tatu Saloranta (upstream maintainer, not TuxCare).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 concerns a jackson-databind deserialization gadget vulnerability related to org.apache.commons.jelly.impl.Embedded. The target (jackson-databind 2.19.4-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream release 2.19.4 that TuxCare onboarded. The fix adds the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 189), which is enforced during polymorphic deserialization. Any attempt to deserialize this class is rejected with a security exception. The fix commit (77040d85e3 by tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit (d3dea6694a \"Onboard version 2.19.4\"), confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 concerns a jackson-databind deserialization gadget vulnerability related to org.apache.commons.jelly.impl.Embedded. The target (jackson-databind 2.19.4-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream release 2.19.4 that TuxCare onboarded. The fix adds the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (line 189), which is enforced during polymorphic deserialization. Any attempt to deserialize this class is rejected with a security exception. The fix commit (77040d85e3 by tatu.saloranta@iki.fi) is an ancestor of the first TuxCare commit (d3dea6694a \"Onboard version 2.19.4\"), confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of the dangerous class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool that enables remote code execution via JNDI injection. The fix (blacklisting this class in SubTypeValidator) was committed upstream by Tatu Saloranta in April 2020 (commit d1c67a0396) for release 2.9.10.5. Version 2.19.4, released much later, already includes this fix. When TuxCare onboarded upstream version 2.19.4 (commit d3dea6694a on 2026-10-29), the blacklist entry was already present. No TuxCare backport of CVE-2020-14060 exists for the 2.19.4 branch because it was unnecessary\u2014the upstream release already contained the protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of the dangerous class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool that enables remote code execution via JNDI injection. The fix (blacklisting this class in SubTypeValidator) was committed upstream by Tatu Saloranta in April 2020 (commit d1c67a0396) for release 2.9.10.5. Version 2.19.4, released much later, already includes this fix. When TuxCare onboarded upstream version 2.19.4 (commit d3dea6694a on 2026-10-29), the blacklist entry was already present. No TuxCare backport of CVE-2020-14060 exists for the 2.19.4 branch because it was unnecessary\u2014the upstream release already contained the protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind versions before 2.9.10.5 due to deserialization gadget vulnerabilities in Oracle JMS connection factory classes. The target repository version 2.19.4-tuxcare.2 is NOT AFFECTED because the fix was already included in the upstream release. The five Oracle JMS classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 200-204). This fix was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae9 (April 24, 2020) and shipped in version 2.9.10.5, well before the 2.19.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 affects jackson-databind versions before 2.9.10.5 due to deserialization gadget vulnerabilities in Oracle JMS connection factory classes. The target repository version 2.19.4-tuxcare.2 is NOT AFFECTED because the fix was already included in the upstream release. The five Oracle JMS classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 200-204). This fix was authored by upstream maintainer Tatu Saloranta in commit 5c8642aeae9 (April 24, 2020) and shipped in version 2.9.10.5, well before the 2.19.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a missing blacklist entry for the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class. The target version 2.19.4-tuxcare.2 is NOT vulnerable because the fix was already present in the upstream release. The fix (commit 840eae2ca8 by upstream maintainer Tatu Saloranta) adds the gadget class to SubTypeValidator's blacklist at line 119, preventing exploitation via JNDI injection during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to a missing blacklist entry for the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget class. The target version 2.19.4-tuxcare.2 is NOT vulnerable because the fix was already present in the upstream release. The fix (commit 840eae2ca8 by upstream maintainer Tatu Saloranta) adds the gadget class to SubTypeValidator's blacklist at line 119, preventing exploitation via JNDI injection during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.4 is not vulnerable to CVE-2020-14195. The fix that blocks deserialization of org.jsecurity.realm.jndi.JndiRealmFactory was already present in the upstream 2.19.4 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "Target version 2.19.4 is not vulnerable to CVE-2020-14195. The fix that blocks deserialization of org.jsecurity.realm.jndi.JndiRealmFactory was already present in the upstream 2.19.4 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:15.181090+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target version 2.19.4-tuxcare.2 is not affected by CVE-2020-24616. The vulnerability was fixed in upstream version 2.9.10.6 (released August 2020) by adding \"br.com.anteros.dbcp.AnterosDBCPDataSource\" to the SubTypeValidator blacklist. This fix was already present in the upstream 2.19.4 release when TuxCare onboarded it in commit d3dea6694a. The vulnerable code pattern (missing blacklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "The target version 2.19.4-tuxcare.2 is not affected by CVE-2020-24616. The vulnerability was fixed in upstream version 2.9.10.6 (released August 2020) by adding \"br.com.anteros.dbcp.AnterosDBCPDataSource\" to the SubTypeValidator blacklist. This fix was already present in the upstream 2.19.4 release when TuxCare onboarded it in commit d3dea6694a. The vulnerable code pattern (missing blacklist entry) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:18:09.376674+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x before 2.9.10.6. The target version 2.19.4-tuxcare.2 is far beyond this range. The fix (blacklisting com.pastdev.httpcomponents.configuration.JndiConfiguration) was already present in the upstream 2.19.4 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked at SubTypeValidator.java:210.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.6.7.5 and 2.7.x before 2.9.10.6. The target version 2.19.4-tuxcare.2 is far beyond this range. The fix (blacklisting com.pastdev.httpcomponents.configuration.JndiConfiguration) was already present in the upstream 2.19.4 release that TuxCare onboarded. The vulnerable deserialization gadget is blocked at SubTypeValidator.java:210.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.4-tuxcare.2 is NOT affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The upstream vendor (FasterXML) fixed this vulnerability in version 2.11.0 (January 2020) by adding two XML parser security features to DOMDeserializer.java: (1) disallow-doctype-decl=true and (2) load-external-dtd=false. Since the target version 2.19.4 is significantly newer than 2.11.0, it already contains the fix from the upstream release. The fix commit (612f971b78) by upstream author Tatu Saloranta was already present before TuxCare onboarded version 2.19.4. The vulnerable code pattern (XML parser processing DOCTYPE/external DTD without restrictions) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "The target jackson-databind 2.19.4-tuxcare.2 is NOT affected by CVE-2020-25649 (XXE vulnerability in DOMDeserializer). The upstream vendor (FasterXML) fixed this vulnerability in version 2.11.0 (January 2020) by adding two XML parser security features to DOMDeserializer.java: (1) disallow-doctype-decl=true and (2) load-external-dtd=false. Since the target version 2.19.4 is significantly newer than 2.11.0, it already contains the fix from the upstream release. The fix commit (612f971b78) by upstream author Tatu Saloranta was already present before TuxCare onboarded version 2.19.4. The vulnerable code pattern (XML parser processing DOCTYPE/external DTD without restrictions) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:23:14.032161+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.19.4-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by Tatu Saloranta) was already shipped in the upstream 2.19.4 release before TuxCare onboarded it. The fix adds both gadget classes to the SubTypeValidator blocklist, preventing their deserialization and blocking the attack chain from malicious JSON input to RCE goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.19.4-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by Tatu Saloranta) was already shipped in the upstream 2.19.4 release before TuxCare onboarded it. The fix adds both gadget classes to the SubTypeValidator blocklist, preventing their deserialization and blocking the attack chain from malicious JSON input to RCE goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:52.202330+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target version 2.19.4 is not affected by CVE-2020-35491. The vulnerability involves deserialization gadgets in apache commons dbcp2 datasource classes (SharedPoolDataSource and PerUserPoolDataSource) that could enable arbitrary code execution or JNDI injection. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta, December 2020) added these classes to Jackson's deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.8 and carried forward to 2.19.4, which TuxCare onboarded. The target contains the complete fix at lines 216-219 of SubTypeValidator.java, blocking the vulnerable classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "The target version 2.19.4 is not affected by CVE-2020-35491. The vulnerability involves deserialization gadgets in apache commons dbcp2 datasource classes (SharedPoolDataSource and PerUserPoolDataSource) that could enable arbitrary code execution or JNDI injection. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta, December 2020) added these classes to Jackson's deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.8 and carried forward to 2.19.4, which TuxCare onboarded. The target contains the complete fix at lines 216-219 of SubTypeValidator.java, blocking the vulnerable classes from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:55:46.062749+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8. The target version 2.19.4-tuxcare.2 already contains the upstream fix. The vulnerable gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool' is present in the deserialization blacklist at SubTypeValidator.java:240, preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.19.4, which TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8. The target version 2.19.4-tuxcare.2 already contains the upstream fix. The vulnerable gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool' is present in the deserialization blacklist at SubTypeValidator.java:240, preventing exploitation. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.19.4, which TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects Jackson databind versions before 2.9.10.8 due to missing blocklist entries for DriverAdapterCPDS deserialization gadgets. The target (jackson-databind 2.19.4-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 3ded28aece) was already present in the upstream 2.19.4 release that TuxCare onboarded. All required blocklist entries are present in SubTypeValidator.java, preventing deserialization of the dangerous gadget classes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 affects Jackson databind versions before 2.9.10.8 due to missing blocklist entries for DriverAdapterCPDS deserialization gadgets. The target (jackson-databind 2.19.4-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 3ded28aece) was already present in the upstream 2.19.4 release that TuxCare onboarded. All required blocklist entries are present in SubTypeValidator.java, preventing deserialization of the dangerous gadget classes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:41:47.392844+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability concerns deserialization gadgets related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding five DriverAdapterCPDS class variants to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.19.4, which TuxCare onboarded. All five blocked class variants are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, and SubTypeValidator.validateSubType() is actively invoked by BeanDeserializerFactory during deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is not present in jackson-databind 2.19.4-tuxcare.2. The vulnerability concerns deserialization gadgets related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding five DriverAdapterCPDS class variants to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.19.4, which TuxCare onboarded. All five blocked class variants are present in the target at lines 123, 193, 219, 228, and 234 of SubTypeValidator.java, and SubTypeValidator.validateSubType() is actively invoked by BeanDeserializerFactory during deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:46.608372+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`. The upstream fix (commit 3ded28aece from 2020-12-31) added this class to SubTypeValidator's blocklist, preventing its deserialization. This fix was already present in upstream version 2.19.4 when TuxCare onboarded it on 2026-07-09, over 5 years after the fix was applied. The target contains the complete defense: SubTypeValidator.java line 228 blocks the dangerous class, and the validation is properly integrated in the deserialization chain via ClassNameIdResolver \u2192 resolveAndValidateSubType \u2192 validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability involves deserialization of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`. The upstream fix (commit 3ded28aece from 2020-12-31) added this class to SubTypeValidator's blocklist, preventing its deserialization. This fix was already present in upstream version 2.19.4 when TuxCare onboarded it on 2026-07-09, over 5 years after the fix was applied. The target contains the complete defense: SubTypeValidator.java line 228 blocks the dangerous class, and the validation is properly integrated in the deserialization chain via ClassNameIdResolver \u2192 resolveAndValidateSubType \u2192 validateSubType.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:13:47.994162+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.4 is NOT affected by CVE-2020-36182. The upstream fix (commit 3ded28aece by Tatu Saloranta) that adds DriverAdapterCPDS gadget classes to the deserialization blocklist was already included in the upstream jackson-databind 2.19.4 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "Target version 2.19.4 is NOT affected by CVE-2020-36182. The upstream fix (commit 3ded28aece by Tatu Saloranta) that adds DriverAdapterCPDS gadget classes to the deserialization blocklist was already included in the upstream jackson-databind 2.19.4 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:22:01.951264+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 affects jackson-databind versions before 2.9.10.8. The target version 2.19.4 already contains the upstream fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) added by FasterXML maintainer Tatu Saloranta in commit 12e23c962f on Dec 31, 2020. This fix was part of the upstream 2.19.4 release that TuxCare onboarded, so the vulnerable deserialization gadget pattern was never present in this version. The SubTypeValidator blocklist prevents instantiation of the JNDI gadget class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 affects jackson-databind versions before 2.9.10.8. The target version 2.19.4 already contains the upstream fix (blocklist entry for org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) added by FasterXML maintainer Tatu Saloranta in commit 12e23c962f on Dec 31, 2020. This fix was part of the upstream 2.19.4 release that TuxCare onboarded, so the vulnerable deserialization gadget pattern was never present in this version. The SubTypeValidator blocklist prevents instantiation of the JNDI gadget class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.4 is NOT affected by CVE-2020-36184. The vulnerability (missing blacklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes) was fixed by upstream in jackson-databind 2.9.10.8 (December 2020). The fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) is present in the target's SubTypeValidator.java at lines 235-236, shipped as part of the upstream 2.19.4 release. The blacklist entries prevent deserialization of these gadget classes, blocking the attack chain from malicious JSON input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "Target version 2.19.4 is NOT affected by CVE-2020-36184. The vulnerability (missing blacklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes) was fixed by upstream in jackson-databind 2.9.10.8 (December 2020). The fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) is present in the target's SubTypeValidator.java at lines 235-236, shipped as part of the upstream 2.19.4 release. The blacklist entries prevent deserialization of these gadget classes, blocking the attack chain from malicious JSON input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.19.4. The vulnerability involved deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (SharedPoolDataSource and PerUserPoolDataSource). The upstream vendor (FasterXML) fixed this in commit 567194c53ae by adding these class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.19.4 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (d3dea6694a). The blocklist is actively enforced during deserialization validation (SubTypeValidator.java:269), preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.19.4. The vulnerability involved deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes (SharedPoolDataSource and PerUserPoolDataSource). The upstream vendor (FasterXML) fixed this in commit 567194c53ae by adding these class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.19.4 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (d3dea6694a). The blocklist is actively enforced during deserialization validation (SubTypeValidator.java:269), preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:37:15.372164+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target repository is jackson-databind version 2.19.4-tuxcare.2, which already contains the upstream vendor fix. The dangerous classes are blocked in SubTypeValidator.java lines 229-230, preventing deserialization-based code execution. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 on 2020-12-26 and was already present in the 2.19.4 release before TuxCare onboarded it (first TuxCare commit d3dea6694a98dbe1ac2dc0f0eb1d086fde4c2abb).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The target repository is jackson-databind version 2.19.4-tuxcare.2, which already contains the upstream vendor fix. The dangerous classes are blocked in SubTypeValidator.java lines 229-230, preventing deserialization-based code execution. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in upstream commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 on 2020-12-26 and was already present in the 2.19.4 release before TuxCare onboarded it (first TuxCare commit d3dea6694a98dbe1ac2dc0f0eb1d086fde4c2abb).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:19.112170+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to deserialization gadget classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The target version 2.19.4-tuxcare.2 already contains the upstream fix (commit 3e8fa3beea from Dec 2020) that adds these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was present in the upstream release 2.19.4 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to deserialization gadget classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource. The target version 2.19.4-tuxcare.2 already contains the upstream fix (commit 3e8fa3beea from Dec 2020) that adds these classes to the SubTypeValidator blacklist, preventing their deserialization. This fix was present in the upstream release 2.19.4 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:54:24.198988+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.4 is not affected by CVE-2020-36188. The vulnerability involves deserialization gadgets in newrelic-agent embedded logback classes (JNDIConnectionSource and DriverManagerConnectionSource). The target contains the upstream fix at SubTypeValidator.java:223-224, which blocks these classes from deserialization. This fix (commit 33d96c13fe) was authored by upstream maintainer Tatu Saloranta and was already present in release 2.19.4 when TuxCare onboarded it (commit d3dea6694a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "Target jackson-databind 2.19.4 is not affected by CVE-2020-36188. The vulnerability involves deserialization gadgets in newrelic-agent embedded logback classes (JNDIConnectionSource and DriverManagerConnectionSource). The target contains the upstream fix at SubTypeValidator.java:223-224, which blocks these classes from deserialization. This fix (commit 33d96c13fe) was authored by upstream maintainer Tatu Saloranta and was already present in release 2.19.4 when TuxCare onboarded it (commit d3dea6694a).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.19.4. The vulnerability affects versions before 2.9.10.8, while the target is version 2.19.4 which is significantly newer. The upstream fix (adding com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource to the deserialization blocklist) was applied by upstream maintainer Tatu Saloranta in commit 33d96c13fe1 on 2020-12-26 and was already present in the upstream 2.19.4 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.19.4. The vulnerability affects versions before 2.9.10.8, while the target is version 2.19.4 which is significantly newer. The upstream fix (adding com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource to the deserialization blocklist) was applied by upstream maintainer Tatu Saloranta in commit 33d96c13fe1 on 2020-12-26 and was already present in the upstream 2.19.4 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:28.173576+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 (stack overflow via deep JSON nesting) is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerable recursive implementation (UntypedObjectDeserializer.Vanilla) was replaced by an iterative non-recursive implementation (UntypedObjectDeserializerNR) in upstream commit 8238ab41d0, which shipped in the 2.19.4 release that TuxCare onboarded. The iterative approach eliminates unbounded call-stack recursion, preventing stack overflow. Additionally, jackson-core provides StreamReadConstraints with a default max nesting depth as an ambient defense layer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 (stack overflow via deep JSON nesting) is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerable recursive implementation (UntypedObjectDeserializer.Vanilla) was replaced by an iterative non-recursive implementation (UntypedObjectDeserializerNR) in upstream commit 8238ab41d0, which shipped in the 2.19.4 release that TuxCare onboarded. The iterative approach eliminates unbounded call-stack recursion, preventing stack overflow. Additionally, jackson-core provides StreamReadConstraints with a default max nesting depth as an ambient defense layer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:53.139556+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability required blocking the deserialization gadget class org.apache.xbean.propertyeditor.JndiConverter to prevent JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit 9bb52c7 by adding JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.19.4 when TuxCare onboarded it (commit d3dea6694a9 \"Onboard version 2.19.4\"). The vulnerable pattern is not present because the upstream fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.19.4-tuxcare.2. The vulnerability required blocking the deserialization gadget class org.apache.xbean.propertyeditor.JndiConverter to prevent JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit 9bb52c7 by adding JndiConverter to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.19.4 when TuxCare onboarded it (commit d3dea6694a9 \"Onboard version 2.19.4\"). The vulnerable pattern is not present because the upstream fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to missing denylist entry for the deserialization gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository (jackson-databind 2.19.4-tuxcare.2) is not affected because the upstream fix was already present in the upstream 2.19.4 release before TuxCare onboarded it. The denylist entry exists at line 141 of SubTypeValidator.java, preventing deserialization of this gadget class when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to missing denylist entry for the deserialization gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target repository (jackson-databind 2.19.4-tuxcare.2) is not affected because the upstream fix was already present in the upstream 2.19.4 release before TuxCare onboarded it. The denylist entry exists at line 141 of SubTypeValidator.java, preventing deserialization of this gadget class when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target version jackson-databind 2.19.4 is not affected by CVE-2020-9547. The vulnerability was fixed in upstream version 2.9.10.4 (February 2020) by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the deserialization blocklist. This fix is present in version 2.19.4, which TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:144, preventing deserialization of the malicious gadget class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "The target version jackson-databind 2.19.4 is not affected by CVE-2020-9547. The vulnerability was fixed in upstream version 2.9.10.4 (February 2020) by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the deserialization blocklist. This fix is present in version 2.19.4, which TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:144, preventing deserialization of the malicious gadget class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:19:28.543087+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target repository (jackson-databind 2.19.4-tuxcare.2) is not affected by CVE-2020-9548. The vulnerability involves deserialization of the gadget class `br.com.anteros.dbcp.AnterosDBCPConfig` through Jackson's polymorphic type handling. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream FasterXML jackson-databind 2.19.4 release that TuxCare onboarded. The blocklist entry at line 145 prevents instantiation of this class during deserialization, blocking the attack chain. The fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb (authored by Tatu Saloranta) is an ancestor of HEAD and predates TuxCare's onboarding commit d3dea6694a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "Target repository (jackson-databind 2.19.4-tuxcare.2) is not affected by CVE-2020-9548. The vulnerability involves deserialization of the gadget class `br.com.anteros.dbcp.AnterosDBCPConfig` through Jackson's polymorphic type handling. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream FasterXML jackson-databind 2.19.4 release that TuxCare onboarded. The blocklist entry at line 145 prevents instantiation of this class during deserialization, blocking the attack chain. The fix commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb (authored by Tatu Saloranta) is an ancestor of HEAD and predates TuxCare's onboarding commit d3dea6694a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:16:55.064774+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.19.4. The vulnerability involved missing gadget classes (specifically javax.swing.JTextPane) in the deserialization blocklist. The fix was authored by upstream maintainer Tatu Saloranta in commit 7dbf51bf78d (2020-09-17) and was already included in the upstream release 2.19.4 when TuxCare onboarded it (2026-07-09). The target's SubTypeValidator.java contains the complete blocklist including javax.swing.JTextPane and all other gadget classes from the security patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.19.4. The vulnerability involved missing gadget classes (specifically javax.swing.JTextPane) in the deserialization blocklist. The fix was authored by upstream maintainer Tatu Saloranta in commit 7dbf51bf78d (2020-09-17) and was already included in the upstream release 2.19.4 when TuxCare onboarded it (2026-07-09). The target's SubTypeValidator.java contains the complete blocklist including javax.swing.JTextPane and all other gadget classes from the security patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.4 is not affected by CVE-2021-46877. The upstream fix (commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta) was already present in the upstream release before TuxCare onboarded version 2.19.4. The vulnerable code pattern (unbounded heap allocation based on attacker-controlled deserialization data) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "Target version 2.19.4 is not affected by CVE-2021-46877. The upstream fix (commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta) was already present in the upstream release before TuxCare onboarded version 2.19.4. The vulnerable code pattern (unbounded heap allocation based on attacker-controlled deserialization data) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:02.879946+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 fix is present in jackson-databind 2.19.4. The vulnerability affects primitive value deserializers when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, allowing resource exhaustion via deeply nested arrays. The upstream fix (authored by Tatu Saloranta in commit d78d00ee7b) adds checks in StdDeserializer primitive methods and BeanDeserializer to reject nested arrays beyond a single wrapper level. This fix was already included in upstream jackson-databind 2.19.4 when TuxCare onboarded the version (first TuxCare commit d3dea6694a \"Onboard version 2.19.4\"). All affected code paths have the defense: handleNestedArrayForSingle() is called when p.nextToken() == START_ARRAY during unwrapping, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 fix is present in jackson-databind 2.19.4. The vulnerability affects primitive value deserializers when UNWRAP_SINGLE_VALUE_ARRAYS is enabled, allowing resource exhaustion via deeply nested arrays. The upstream fix (authored by Tatu Saloranta in commit d78d00ee7b) adds checks in StdDeserializer primitive methods and BeanDeserializer to reject nested arrays beyond a single wrapper level. This fix was already included in upstream jackson-databind 2.19.4 when TuxCare onboarded the version (first TuxCare commit d3dea6694a \"Onboard version 2.19.4\"). All affected code paths have the defense: handleNestedArrayForSingle() is called when p.nextToken() == START_ARRAY during unwrapping, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:00:13.288450+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 affects jackson-databind versions before 2.12.7.1 and 2.13.x before 2.13.4. The target version 2.19.4 already contains the upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) that was shipped in the upstream 2.19.4 release before TuxCare onboarded it. The vulnerable pattern (unbounded nested array processing when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) is not present because the defense code exists in BeanDeserializer._deserializeFromArray() that detects and rejects deeply-nested arrays.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 affects jackson-databind versions before 2.12.7.1 and 2.13.x before 2.13.4. The target version 2.19.4 already contains the upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) that was shipped in the upstream 2.19.4 release before TuxCare onboarded it. The vulnerable pattern (unbounded nested array processing when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) is not present because the defense code exists in BeanDeserializer._deserializeFromArray() that detects and rejects deeply-nested arrays.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:23:00.112323+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 describes a DoS vulnerability where deeply nested JSON (1000s of levels) causes StackOverflowError when serialized via JsonNode.toString(). The upstream fix (commit a1fa4ae4ec, issue #3447) replaced recursive serialization with iterative serialization using an explicit IteratorStack. This fix shipped in upstream jackson-databind 2.14.0 and is present in the target version 2.19.4....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 describes a DoS vulnerability where deeply nested JSON (1000s of levels) causes StackOverflowError when serialized via JsonNode.toString(). The upstream fix (commit a1fa4ae4ec, issue #3447) replaced recursive serialization with iterative serialization using an explicit IteratorStack. This fix shipped in upstream jackson-databind 2.14.0 and is present in the target version 2.19.4...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:20:00.117354+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.19.4 is NOT affected by CVE-2026-54516. The vulnerability was introduced by upstream commit 1fe6ee7a89 (#5398, Nov 2025) which modified POJOPropertiesCollector._renameProperties() to allow renaming of properties with ignored setters. Version 2.19.4 predates this change and has the #4628 safe behavior (simple `continue` check at lines 1429-1431) that prevents ALL renaming of pro...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "impact_statement": "not_affected \u2014 Target version 2.19.4 is NOT affected by CVE-2026-54516. The vulnerability was introduced by upstream commit 1fe6ee7a89 (#5398, Nov 2025) which modified POJOPropertiesCollector._renameProperties() to allow renaming of properties with ignored setters. Version 2.19.4 predates this change and has the #4628 safe behavior (simple `continue` check at lines 1429-1431) that prevents ALL renaming of pro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T02:46:07.887942+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.19.4 is NOT AFFECTED by CVE-2026-54517. The vulnerability was introduced in jackson-databind 2.21.0 by databind#5237 (commit ff8c5a22c6, Aug 2025), which added special handling to buffer and apply setterless/merging properties during property-based creator deserialization. The target version 2.19.4 predates this mechanism\u2014attempting to buffer a SetterlessProperty in 2.19.4 would fail ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.19.4 is NOT AFFECTED by CVE-2026-54517. The vulnerability was introduced in jackson-databind 2.21.0 by databind#5237 (commit ff8c5a22c6, Aug 2025), which added special handling to buffer and apply setterless/merging properties during property-based creator deserialization. The target version 2.19.4 predates this mechanism\u2014attempting to buffer a SetterlessProperty in 2.19.4 would fail ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "action_statement": "Vulnerability CVE-2026-54518 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:20.838369+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:20.838369+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:34.370470+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:23.480929+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.19.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:24:11.874004+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.19.4-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}