{
  "@id": "urn:uuid:f58e97db-1bd4-4bbc-afae-6f7fa9082a7f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 62,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:23:21.346897+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.20.1-tuxcare.3. The vulnerability requires the ability to deserialize the gadget class `com.sun.rowset.JdbcRowSetImpl` through polymorphic type handling. The upstream vendor fix (commit e8f043d1, issue #1680) added this class to the deserialization blacklist in SubTypeValidator, blocking the attack. This fix was already present in upstream release 2.10.0+ (released 2019) and was included in the 2.20.1 release that TuxCare onboarded. The blacklist check executes on every bean deserialization attempt via BeanDeserializerFactory._validateSubType \u2192 SubTypeValidator.validateSubType, preventing instantiation of blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.20.1-tuxcare.3. The vulnerability requires the ability to deserialize the gadget class `com.sun.rowset.JdbcRowSetImpl` through polymorphic type handling. The upstream vendor fix (commit e8f043d1, issue #1680) added this class to the deserialization blacklist in SubTypeValidator, blocking the attack. This fix was already present in upstream release 2.10.0+ (released 2019) and was included in the 2.20.1 release that TuxCare onboarded. The blacklist check executes on every bean deserialization attempt via BeanDeserializerFactory._validateSubType \u2192 SubTypeValidator.validateSubType, preventing instantiation of blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.20.1. The complete fix, including SubTypeValidator with all blacklist entries (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring types with hierarchical checking, c3p0 types, Apache Tomcat/BCEL types) and integration into BeanDeserializerFactory, was already present in the upstream release 2.20.1 before TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 2235894210 as part of databind#1855, which addressed the incomplete blacklist that allowed Spring-based deserialization gadgets to bypass previous protections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.20.1. The complete fix, including SubTypeValidator with all blacklist entries (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring types with hierarchical checking, c3p0 types, Apache Tomcat/BCEL types) and integration into BeanDeserializerFactory, was already present in the upstream release 2.20.1 before TuxCare onboarded it. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 2235894210 as part of databind#1855, which addressed the incomplete blacklist that allowed Spring-based deserialization gadgets to bypass previous protections.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:37:15.372164+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.20.1 is significantly newer and already includes the upstream fix. The vulnerability allowed arbitrary code execution via unsafe deserialization of dangerous classes like TemplatesImpl when default typing was enabled. The fix, implemented via SubTypeValidator with a comprehensive blacklist of dangerous classes, was authored by the upstream vendor (tatu.saloranta@iki.fi) and shipped in the upstream 2.20.1 release before TuxCare onboarded it. The defense mechanism is present and active at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java, blocking deserialization of TemplatesImpl and other gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.20.1 is significantly newer and already includes the upstream fix. The vulnerability allowed arbitrary code execution via unsafe deserialization of dangerous classes like TemplatesImpl when default typing was enabled. The fix, implemented via SubTypeValidator with a comprehensive blacklist of dangerous classes, was authored by the upstream vendor (tatu.saloranta@iki.fi) and shipped in the upstream 2.20.1 release before TuxCare onboarded it. The defense mechanism is present and active at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java, blocking deserialization of TemplatesImpl and other gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:24:51.671524+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.20.1-tuxcare.3. The vulnerability involves deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser to exfiltrate data via XXE attacks. The fix (adding XPathParser to the SubTypeValidator blacklist) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc27 (May 2018) and shipped in upstream release 2.20.1, which TuxCare later onboarded. The vulnerable pattern is not present in the target - the blacklist entry exists at SubTypeValidator.java:65, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.20.1-tuxcare.3. The vulnerability involves deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser to exfiltrate data via XXE attacks. The fix (adding XPathParser to the SubTypeValidator blacklist) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc27 (May 2018) and shipped in upstream release 2.20.1, which TuxCare later onboarded. The vulnerable pattern is not present in the target - the blacklist entry exists at SubTypeValidator.java:65, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.20.1-tuxcare.4 is NOT affected by CVE-2018-12022. The fix (blacklisting jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator) was already present in the upstream release 2.20.1 that TuxCare onboarded. The vulnerable pattern (missing gadget class validation) does not exist in the target. The CVE affected versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6; version 2.20.1 is far newer and includes the fix authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "Target jackson-databind 2.20.1-tuxcare.4 is NOT affected by CVE-2018-12022. The fix (blacklisting jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator) was already present in the upstream release 2.20.1 that TuxCare onboarded. The vulnerable pattern (missing gadget class validation) does not exist in the target. The CVE affected versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6; version 2.20.1 is far newer and includes the fix authored by upstream maintainer Tatu Saloranta.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:25:43.115991+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.20.1. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that trigger JNDI/LDAP lookups. The vendor fix adds these classes to a deny-list in SubTypeValidator.java. The target already contains this fix at lines 70-72, blocking deserialization of the gadget classes. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6 and was already present in the upstream 2.20.1 release that TuxCare onboarded (commit 88c055ec9). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.20.1. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that trigger JNDI/LDAP lookups. The vendor fix adds these classes to a deny-list in SubTypeValidator.java. The target already contains this fix at lines 70-72, blocking deserialization of the gadget classes. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6 and was already present in the upstream 2.20.1 release that TuxCare onboarded (commit 88c055ec9). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:03:22.406684+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData and others) that could lead to arbitrary code execution. The fix, which adds these classes to a deserialization blocklist in SubTypeValidator, was already included in the upstream release 2.10.0 (committed by upstream maintainer Tatu Saloranta on 2018-08-16, commit 87d29af25e). This fix was present in the upstream version 2.20.1 when TuxCare onboarded it. The target is protected by the blocklist in SubTypeValidator.java lines 75-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData and others) that could lead to arbitrary code execution. The fix, which adds these classes to a deserialization blocklist in SubTypeValidator, was already included in the upstream release 2.10.0 (committed by upstream maintainer Tatu Saloranta on 2018-08-16, commit 87d29af25e). This fix was present in the upstream version 2.20.1 when TuxCare onboarded it. The target is protected by the blocklist in SubTypeValidator.java lines 75-78.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5. The target version 2.20.1 already contains the upstream fix (commit 87d29af25e) that blocks dangerous classes including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (BlazeDS), org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization. This fix shipped in upstream release 2.20.1 before TuxCare onboarded the version, so the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5. The target version 2.20.1 already contains the upstream fix (commit 87d29af25e) that blocks dangerous classes including flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (BlazeDS), org.slf4j.ext.EventData, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization. This fix shipped in upstream release 2.20.1 before TuxCare onboarded the version, so the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:11:33.363226+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.20.1. The vulnerability affects versions before 2.9.7, and the target version 2.20.1 already contains the upstream fix. All four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream maintainer) and included in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.20.1. The vulnerability affects versions before 2.9.7, and the target version 2.20.1 already contains the upstream fix. All four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java. The fix was authored by Tatu Saloranta (upstream maintainer) and included in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:54.716958+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.20.1-tuxcare.4. The fix blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in the upstream 2.20.1 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:78, and the validator is actively called during deserialization (BeanDeserializerFactory.java:142,1121). The fix commit (87d29af25e) was authored by upstream maintainer Tatu Saloranta and shipped in the base release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.20.1-tuxcare.4. The fix blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in the upstream 2.20.1 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:78, and the validator is actively called during deserialization (BeanDeserializerFactory.java:142,1121). The fix commit (87d29af25e) was authored by upstream maintainer Tatu Saloranta and shipped in the base release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.20.1. The vulnerability involves polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo class, which could lead to arbitrary code execution. The upstream fix (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta, dated 2018-11-19) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.20.1 before TuxCare onboarded it (first TuxCare commit: 88c055ec918e31e2f57c9d1fe7320f22c2932949). The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.20.1. The vulnerability involves polymorphic deserialization of the org.apache.axis2.transport.jms.JMSOutTransportInfo class, which could lead to arbitrary code execution. The upstream fix (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta, dated 2018-11-19) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.20.1 before TuxCare onboarded it (first TuxCare commit: 88c055ec918e31e2f57c9d1fe7320f22c2932949). The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:03:58.617275+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.20.1-tuxcare.4 is not affected by CVE-2018-19361. The vulnerability required blocking OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. These classes are already blacklisted in SubTypeValidator.java at lines 82-84. The fix (commit 72cd4025a2) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.20.1 that TuxCare onboarded, before any TuxCare backport work began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "The target jackson-databind 2.20.1-tuxcare.4 is not affected by CVE-2018-19361. The vulnerability required blocking OpenJPA classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. These classes are already blacklisted in SubTypeValidator.java at lines 82-84. The fix (commit 72cd4025a2) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.20.1 that TuxCare onboarded, before any TuxCare backport work began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for jboss-common-core and other dangerous classes exploitable via polymorphic deserialization. The target version 2.20.1 already contains the upstream fix (commit 42912cac4753f3f718ece875e4d486f8264c2f2b from November 2018) which adds org.jboss.util.propertyeditor.DocumentEditor and three other classes to the SubTypeValidator blocklist. This fix was part of the upstream release 2.20.1 that TuxCare onboarded, not a TuxCare backport. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for jboss-common-core and other dangerous classes exploitable via polymorphic deserialization. The target version 2.20.1 already contains the upstream fix (commit 42912cac4753f3f718ece875e4d486f8264c2f2b from November 2018) which adds org.jboss.util.propertyeditor.DocumentEditor and three other classes to the SubTypeValidator blocklist. This fix was part of the upstream release 2.20.1 that TuxCare onboarded, not a TuxCare backport. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.20.1-tuxcare.4 is NOT AFFECTED by CVE-2018-5968. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the deserialization blacklist and enable remote code execution. The upstream fix (commit 038b471e2e by Tatu Saloranta, January 2018) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream Jackson 2.20.1 release that TuxCare onboarded in July 2026, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "Target jackson-databind version 2.20.1-tuxcare.4 is NOT AFFECTED by CVE-2018-5968. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the deserialization blacklist and enable remote code execution. The upstream fix (commit 038b471e2e by Tatu Saloranta, January 2018) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream Jackson 2.20.1 release that TuxCare onboarded in July 2026, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:29.897304+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.20.1. The upstream fix (commit 6799f8f10c by Tatu Saloranta) that blocks c3p0 DataSource deserialization was already included in Jackson 2.20.1 when TuxCare onboarded it. The SubTypeValidator contains PREFIX_C3P0 checking logic (lines 288-298) that prevents deserialization of com.mchange.v2.c3p0.*DataSource classes, fully mitigating the vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.20.1. The upstream fix (commit 6799f8f10c by Tatu Saloranta) that blocks c3p0 DataSource deserialization was already included in Jackson 2.20.1 when TuxCare onboarded it. The SubTypeValidator contains PREFIX_C3P0 checking logic (lines 288-298) that prevents deserialization of com.mchange.v2.c3p0.*DataSource classes, fully mitigating the vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:37:30.400386+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind version 2.20.1-tuxcare.4. The vulnerability involves unrestricted polymorphic deserialization of the gadget class com.mysql.cj.jdbc.admin.MiniAdmin, which can be exploited to read arbitrary local files when Default Typing is enabled. The fix (adding MiniAdmin to the SubTypeValidator blocklist) was applied by upstream FasterXML in version 2.9.9 (commit dda513bd72) and is present at line 88 of SubTypeValidator.java in the target. This upstream fix was already in the codebase before TuxCare onboarding (first TuxCare commit a7a5ae30fc). The target version 2.20.1 is significantly newer than the affected range (before 2.9.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind version 2.20.1-tuxcare.4. The vulnerability involves unrestricted polymorphic deserialization of the gadget class com.mysql.cj.jdbc.admin.MiniAdmin, which can be exploited to read arbitrary local files when Default Typing is enabled. The fix (adding MiniAdmin to the SubTypeValidator blocklist) was applied by upstream FasterXML in version 2.9.9 (commit dda513bd72) and is present at line 88 of SubTypeValidator.java in the target. This upstream fix was already in the codebase before TuxCare onboarding (first TuxCare commit a7a5ae30fc). The target version 2.20.1 is significantly newer than the affected range (before 2.9.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T18:52:00.183219+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 via polymorphic deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource. The target version 2.20.1-tuxcare.4 contains the upstream fix in SubTypeValidator.java:90-91, blacklisting the vulnerable class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.9.1, well before TuxCare onbo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 via polymorphic deserialization of ch.qos.logback.core.db.DriverManagerConnectionSource. The target version 2.20.1-tuxcare.4 contains the upstream fix in SubTypeValidator.java:90-91, blacklisting the vulnerable class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.9.1, well before TuxCare onbo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T07:31:51.997293+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled and JDOM is in the classpath. The vulnerability allows arbitrary local file reads via polymorphic deserialization of org.jdom.transform.XSLTransformer or org.jdom2.transform.XSLTransformer. The target (jackson-databind 2.20.1-tuxcare.4) contains the upstream fix (commit 5f7c69bba0) that adds these classes t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled and JDOM is in the classpath. The vulnerability allows arbitrary local file reads via polymorphic deserialization of org.jdom.transform.XSLTransformer or org.jdom2.transform.XSLTransformer. The target (jackson-databind 2.20.1-tuxcare.4) contains the upstream fix (commit 5f7c69bba0) that adds these classes t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind v2.20.1-tuxcare.3 is NOT affected by CVE-2019-14379. The vulnerable pattern (missing blacklist entry for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) is absent because the upstream fix by Tatu Saloranta (commit ad418eeb97) was already included in the v2.20.1 release that TuxCare onboarded. The blacklist entry is present at line 98 of SubTypeValidator.java and is actively enforced during deserialization at BeanDeserializerFactory.java:1121.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target jackson-databind v2.20.1-tuxcare.3 is NOT affected by CVE-2019-14379. The vulnerable pattern (missing blacklist entry for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) is absent because the upstream fix by Tatu Saloranta (commit ad418eeb97) was already included in the v2.20.1 release that TuxCare onboarded. The blacklist entry is present at line 98 of SubTypeValidator.java and is actively enforced during deserialization at BeanDeserializerFactory.java:1121.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind's polymorphic deserialization, allowing remote code execution via JNDI injection when Default Typing is enabled and logback is in the classpath. The vulnerability exploits missing blocklist validation for ch.qos.logback.core.db.JNDIConnectionSource. The target version 2.20.1-tuxcare.4 is NOT AFFECTED because the upstream vendor (FasterXML) applied the fix in commit ad418eeb97 before TuxCare onboarded this version. The blocklist entry exists at SubTypeValidator.java:102 and is enforced by validation logic at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind's polymorphic deserialization, allowing remote code execution via JNDI injection when Default Typing is enabled and logback is in the classpath. The vulnerability exploits missing blocklist validation for ch.qos.logback.core.db.JNDIConnectionSource. The target version 2.20.1-tuxcare.4 is NOT AFFECTED because the upstream vendor (FasterXML) applied the fix in commit ad418eeb97 before TuxCare onboarded this version. The blocklist entry exists at SubTypeValidator.java:102 and is enforced by validation logic at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:52:51.215173+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 (jackson-databind polymorphic deserialization gadget via HikariCP classes) is NOT present in jackson-databind 2.20.1-tuxcare.4. The upstream vendor fix that adds com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist was already present in the jackson-databind 2.20.1 release that TuxCare onboarded. The vulnerable code pattern (unblocked HikariConfig/HikariDataSource deserialization) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 (jackson-databind polymorphic deserialization gadget via HikariCP classes) is NOT present in jackson-databind 2.20.1-tuxcare.4. The upstream vendor fix that adds com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the deserialization blocklist was already present in the jackson-databind 2.20.1 release that TuxCare onboarded. The vulnerable code pattern (unblocked HikariConfig/HikariDataSource deserialization) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:01:48.562174+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892: Target jackson-databind 2.20.1-tuxcare.4 is not affected. The fix (blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in upstream release 2.10.0 (2019-09-19) before TuxCare onboarded version 2.20.1. The SubTypeValidator enforces these blocklist entries during polymorphic deserialization, preventing arbitrary code execution via JNDI classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892: Target jackson-databind 2.20.1-tuxcare.4 is not affected. The fix (blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in upstream release 2.10.0 (2019-09-19) before TuxCare onboarded version 2.20.1. The SubTypeValidator enforces these blocklist entries during polymorphic deserialization, preventing arbitrary code execution via JNDI classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability allowed polymorphic deserialization of the malicious class org.apache.xalan.lib.sql.JNDIConnectionPool to achieve arbitrary code execution. The upstream vendor (FasterXML) fixed this by adding the class to the deserialization blocklist in SubTypeValidator.java. This fix (commit 998efd7) was already included in upstream release 2.20.1, which TuxCare onboarded. The target repository contains the fix at line 117 of SubTypeValidator.java, and the blocklist check is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability allowed polymorphic deserialization of the malicious class org.apache.xalan.lib.sql.JNDIConnectionPool to achieve arbitrary code execution. The upstream vendor (FasterXML) fixed this by adding the class to the deserialization blocklist in SubTypeValidator.java. This fix (commit 998efd7) was already included in upstream release 2.20.1, which TuxCare onboarded. The target repository contains the fix at line 117 of SubTypeValidator.java, and the blocklist check is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:41.975072+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is not present in jackson-databind 2.20.1. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could allow attackers to instantiate dangerous objects via crafted JSON input. The upstream fix (commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db by Tatu Saloranta) added HikariDataSource to SubTypeValidator's blocklist and was already included in the upstream 2.20.1 release before TuxCare's onboarding. The defense is active at SubTypeValidator.java:107 and blocks deserialization via validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is not present in jackson-databind 2.20.1. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could allow attackers to instantiate dangerous objects via crafted JSON input. The upstream fix (commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db by Tatu Saloranta) added HikariDataSource to SubTypeValidator's blocklist and was already included in the upstream 2.20.1 release before TuxCare's onboarding. The defense is active at SubTypeValidator.java:107 and blocks deserialization via validateSubType() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:30.450582+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10, involving polymorphic deserialization of commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) that can be exploited for remote code execution when Default Typing is enabled. The target version 2.20.1 is NOT affected because the upstream vendor (Tatu Saloranta) fixed this vulnerability in commits 9593e16c and 328a0f8 by adding these classes to the SubTypeValidator blocklist. Both fix commits were already present in the upstream release before TuxCare onboarded version 2.20.1 (first TuxCare commit: 88c055ec9). The blocklist is enforced at deserialization time via SubTypeValidator.validateSubType(), which throws JsonMappingException when blocked classes are encountered. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind 2.0.0 through 2.9.10, involving polymorphic deserialization of commons-dbcp classes (SharedPoolDataSource, PerUserPoolDataSource) that can be exploited for remote code execution when Default Typing is enabled. The target version 2.20.1 is NOT affected because the upstream vendor (Tatu Saloranta) fixed this vulnerability in commits 9593e16c and 328a0f8 by adding these classes to the SubTypeValidator blocklist. Both fix commits were already present in the upstream release before TuxCare onboarded version 2.20.1 (first TuxCare commit: 88c055ec9). The blocklist is enforced at deserialization time via SubTypeValidator.validateSubType(), which throws JsonMappingException when blocked classes are encountered. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:21:23.053995+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.20.1. The vulnerability involves polymorphic typing that allows deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes) which can lead to remote code execution when Default Typing is enabled. The upstream fix, which adds these class names to a blocklist in SubTypeValidator.java, was committed by Tatu Saloranta on 2019-09-28 and shipped in upstream version 2.20.1. TuxCare onboarded this already-fixed version on 2026-07-10, so the target contains the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.20.1. The vulnerability involves polymorphic typing that allows deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes) which can lead to remote code execution when Default Typing is enabled. The upstream fix, which adds these class names to a blocklist in SubTypeValidator.java, was committed by Tatu Saloranta on 2019-09-28 and shipped in upstream version 2.20.1. TuxCare onboarded this already-fixed version on 2026-07-10, so the target contains the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 polymorphic deserialization gadget vulnerability is NOT present in target jackson-databind 2.20.1-tuxcare.4. The fix (blocklisting net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in SubTypeValidator) was already included in upstream release 2.20.1, which TuxCare onboarded. The dangerous class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 99), preventing polymorphic deserialization of this gadget class. Validation is active by default in BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 polymorphic deserialization gadget vulnerability is NOT present in target jackson-databind 2.20.1-tuxcare.4. The fix (blocklisting net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup in SubTypeValidator) was already included in upstream release 2.20.1, which TuxCare onboarded. The dangerous class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 99), preventing polymorphic deserialization of this gadget class. Validation is active by default in BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:51:16.476690+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.20.1. The upstream vendor (FasterXML) fixed this vulnerability in commit b5a304a985 on October 12, 2019, by adding two log4j-extras class names to the deserialization blacklist. This fix was already included in the upstream 2.20.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (88c055ec918e). The defense mechanism is fully functional: SubTypeValidator.java lines 130-131 contain the blacklisted classes, and the validation logic at line 269 prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.20.1. The upstream vendor (FasterXML) fixed this vulnerability in commit b5a304a985 on October 12, 2019, by adding two log4j-extras class names to the deserialization blacklist. This fix was already included in the upstream 2.20.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (88c055ec918e). The defense mechanism is fully functional: SubTypeValidator.java lines 130-131 contain the blacklisted classes, and the validation logic at line 269 prevents their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions lacking blocklist entries for net.sf.ehcache JNDI gadget classes. The target repository (jackson-databind 2.20.1-tuxcare.4) contains the complete upstream fix in SubTypeValidator.java lines 133-135, which blocks deserialization of GenericJndiSelector and GlassfishSelector. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.2 (per CVE affected version ranges). The fix commits (eb254813cc and fc4214a883) are ancestors of the TuxCare onboarding commit (88c055ec \"Onboard version 2.20.1\"), confirming the fix was already present in the upstream 2.20.1 release that TuxCare onboarded. Verdict: not_affected - the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 affects jackson-databind versions lacking blocklist entries for net.sf.ehcache JNDI gadget classes. The target repository (jackson-databind 2.20.1-tuxcare.4) contains the complete upstream fix in SubTypeValidator.java lines 133-135, which blocks deserialization of GenericJndiSelector and GlassfishSelector. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.10.2 (per CVE affected version ranges). The fix commits (eb254813cc and fc4214a883) are ancestors of the TuxCare onboarding commit (88c055ec \"Onboard version 2.20.1\"), confirming the fix was already present in the upstream 2.20.1 release that TuxCare onboarded. Verdict: not_affected - the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:06.581572+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is not present in jackson-databind 2.20.1. The vulnerability involves unsafe deserialization of three JNDI-related classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) that enable remote code execution. The upstream fix (commit a424c038ba by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.20.1 when TuxCare onboarded the version, as confirmed by the fix commit being an ancestor of the first TuxCare commit (88c055ec918 \"Onboard version 2.20.1\"). The blocklist is enforced through validateSubType() which is called by core deserialization components including BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 is not present in jackson-databind 2.20.1. The vulnerability involves unsafe deserialization of three JNDI-related classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) that enable remote code execution. The upstream fix (commit a424c038ba by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.20.1 when TuxCare onboarded the version, as confirmed by the fix commit being an ancestor of the first TuxCare commit (88c055ec918 \"Onboard version 2.20.1\"). The blocklist is enforced through validateSubType() which is called by core deserialization components including BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672: The target jackson-databind 2.20.1-tuxcare.4 is NOT AFFECTED. The vulnerability concerns deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to SubTypeValidator's blocklist) was committed by upstream maintainer Tatu Saloranta on 2020-03-15 (commit 592872f4) and shipped in the upstream 2.20.1 release that TuxCare onboarded. The blocklist entry exists at line 163 of SubTypeValidator.java and is enforced during deserialization by BeanDeserializerFactory, preventing instantiation of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672: The target jackson-databind 2.20.1-tuxcare.4 is NOT AFFECTED. The vulnerability concerns deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to SubTypeValidator's blocklist) was committed by upstream maintainer Tatu Saloranta on 2020-03-15 (commit 592872f4) and shipped in the upstream 2.20.1 release that TuxCare onboarded. The blocklist entry exists at line 163 of SubTypeValidator.java and is enforced during deserialization by BeanDeserializerFactory, preventing instantiation of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:34:22.136729+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.20.1-tuxcare.4. The fix (blocklisting com.caucho.config.types.ResourceRef from deserialization) was already included in the upstream release 2.20.1 before TuxCare onboarding. The vulnerable code pattern does not exist in this version because the upstream vendor (FasterXML) applied the fix in commit 1645efbd392989cf015f459a91c999e59c921b15, which predates the first TuxCare commit in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.20.1-tuxcare.4. The fix (blocklisting com.caucho.config.types.ResourceRef from deserialization) was already included in the upstream release 2.20.1 before TuxCare onboarding. The vulnerable code pattern does not exist in this version because the upstream vendor (FasterXML) applied the fix in commit 1645efbd392989cf015f459a91c999e59c921b15, which predates the first TuxCare commit in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entries for org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The target version 2.20.1 already contains the upstream vendor's fix (commit 05d7e0e13f) which added these classes to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream release before TuxCare onboarding (commit 88c055ec91), making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to missing blacklist entries for org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class. The target version 2.20.1 already contains the upstream vendor's fix (commit 05d7e0e13f) which added these classes to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream release before TuxCare onboarding (commit 88c055ec91), making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.20.1-tuxcare.4) is not affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget class in Jackson's polymorphic type handling. The fix, which adds JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 150), was already present in the upstream 2.20.1 release before TuxCare onboarding. The fix commit (6ba48457984943df0de92c54144f7dcae01b1221) by upstream maintainer Tatu Saloranta is an ancestor of both the TuxCare onboarding commit and the current HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target repository (jackson-databind 2.20.1-tuxcare.4) is not affected by CVE-2020-10969. The vulnerability involves deserialization of javax.swing.JEditorPane as a gadget class in Jackson's polymorphic type handling. The fix, which adds JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 150), was already present in the upstream 2.20.1 release before TuxCare onboarding. The fix commit (6ba48457984943df0de92c54144f7dcae01b1221) by upstream maintainer Tatu Saloranta is an ancestor of both the TuxCare onboarding commit and the current HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.activemq.* classes. The target repository (jackson-databind 2.20.1-tuxcare.4) contains the upstream vendor fix that adds all affected activemq classes to the SubTypeValidator blacklist. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) in commit c14c9f99ed and shipped in the upstream release 2.20.1 before TuxCare onboarded it. The vulnerable pattern is not present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.activemq.* classes. The target repository (jackson-databind 2.20.1-tuxcare.4) contains the upstream vendor fix that adds all affected activemq classes to the SubTypeValidator blacklist. This fix was authored by the upstream FasterXML maintainer (tatu.saloranta@iki.fi) in commit c14c9f99ed and shipped in the upstream release 2.20.1 before TuxCare onboarded it. The vulnerable pattern is not present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.20.1-tuxcare.4) contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 186). The fix was authored by Tatu Saloranta and shipped in the upstream release 2.20.1 before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.20.1-tuxcare.4) contains the upstream fix that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 186). The fix was authored by Tatu Saloranta and shipped in the upstream release 2.20.1 before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a missing blacklist entry for the deserialization gadget org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository (version 2.20.1-tuxcare.4) already contains the upstream fix (commit e2ba12d5d by Tatu Saloranta, March 28, 2020) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The fix was shipped in upstream version 2.9.10.4 and is present in all subsequent versions including 2.20.1. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a missing blacklist entry for the deserialization gadget org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository (version 2.20.1-tuxcare.4) already contains the upstream fix (commit e2ba12d5d by Tatu Saloranta, March 28, 2020) that adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The fix was shipped in upstream version 2.9.10.4 and is present in all subsequent versions including 2.20.1. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.20.1-tuxcare.4) is not affected by CVE-2020-11619. The vulnerability was fixed in upstream jackson-databind 2.9.10.4 (April 2020) by commit 113e89fb08, which added blocklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to SubTypeValidator.java. Since the target version 2.20.1 is significantly later than 2.9.10.4, the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target repository (jackson-databind 2.20.1-tuxcare.4) is not affected by CVE-2020-11619. The vulnerability was fixed in upstream jackson-databind 2.9.10.4 (April 2020) by commit 113e89fb08, which added blocklist entries for org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean to SubTypeValidator.java. Since the target version 2.20.1 is significantly later than 2.9.10.4, the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involved deserialization gadgets allowing arbitrary code execution through the org.apache.commons.jelly.impl.Embedded class. The upstream vendor (FasterXML) fixed this in commit 77040d85e3 (April 7, 2020) by adding the malicious class to the SubTypeValidator blocklist. This fix was already present in upstream version 2.20.1 when TuxCare onboarded it (first TuxCare commit: 88c055ec918e on the onboarding), making this an upstream-authored fix rather than a TuxCare backport. The target version ships with the protection already in place at line 189 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involved deserialization gadgets allowing arbitrary code execution through the org.apache.commons.jelly.impl.Embedded class. The upstream vendor (FasterXML) fixed this in commit 77040d85e3 (April 7, 2020) by adding the malicious class to the SubTypeValidator blocklist. This fix was already present in upstream version 2.20.1 when TuxCare onboarded it (first TuxCare commit: 88c055ec918e on the onboarding), making this an upstream-authored fix rather than a TuxCare backport. The target version ships with the protection already in place at line 189 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.20.1 is NOT affected by CVE-2020-14060. The vulnerability (deserialization of gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) was fixed by upstream commit d1c67a0396 which was already included in upstream release 2.20.1 before TuxCare onboarded it. The fix adds the gadget class to SubTypeValidator's blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing its deserialization. The blocklist entry is present at SubTypeValidator.java:192 and actively enforced during all bean deserializations via BeanDeserializerFactory:142. TuxCare backported this CVE fix to older versions (2.6.x-2.9.x) but version 2.20.1 did not require a backport as it was already beyond the vulnerable range (before 2.9.10.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "Target jackson-databind version 2.20.1 is NOT affected by CVE-2020-14060. The vulnerability (deserialization of gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) was fixed by upstream commit d1c67a0396 which was already included in upstream release 2.20.1 before TuxCare onboarded it. The fix adds the gadget class to SubTypeValidator's blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing its deserialization. The blocklist entry is present at SubTypeValidator.java:192 and actively enforced during all bean deserializations via BeanDeserializerFactory:142. TuxCare backported this CVE fix to older versions (2.6.x-2.9.x) but version 2.20.1 did not require a backport as it was already beyond the vulnerable range (before 2.9.10.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns deserialization of Oracle JMS classes (oracle.jms.AQjms*) that can be exploited as serialization gadgets. The fix, which adds these 5 classes to a deserialization blocklist in SubTypeValidator.java, was already present in upstream version 2.20.1 before TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns deserialization of Oracle JMS classes (oracle.jms.AQjms*) that can be exploited as serialization gadgets. The fix, which adds these 5 classes to a deserialization blocklist in SubTypeValidator.java, was already present in upstream version 2.20.1 before TuxCare onboarded it. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to the dangerous deserialization gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target repository (jackson-databind 2.20.1) is not affected because the fix was already present in the upstream 2.20.1 release. The vulnerable class is explicitly blocked in SubTypeValidator.java at line 119, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 840eae2ca8 and was included in the upstream release before TuxCare onboarded version 2.20.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5 due to the dangerous deserialization gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target repository (jackson-databind 2.20.1) is not affected because the fix was already present in the upstream 2.20.1 release. The vulnerable class is explicitly blocked in SubTypeValidator.java at line 119, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 840eae2ca8 and was included in the upstream release before TuxCare onboarded version 2.20.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory. The target version 2.20.1-tuxcare.4 contains the upstream fix (commit f6d9c664f6) that adds this class to the deserialization blacklist at SubTypeValidator.java:207. This fix was already present in the upstream jackson-databind 2.20.1 release before TuxCare onboarded it. The vulnerable pattern (ability to deserialize the gadget class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory. The target version 2.20.1-tuxcare.4 contains the upstream fix (commit f6d9c664f6) that adds this class to the deserialization blacklist at SubTypeValidator.java:207. This fix was already present in the upstream jackson-databind 2.20.1 release before TuxCare onboarded it. The vulnerable pattern (ability to deserialize the gadget class) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:45.297248+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.20.1-tuxcare.4 is NOT vulnerable to CVE-2020-24616. The fix preventing deserialization of br.com.anteros.dbcp.AnterosDBCPDataSource was already present in upstream version 2.20.1 when TuxCare onboarded it. The blacklist entry exists at SubTypeValidator.java:147, blocking the deserialization gadget. The fix was authored by upstream maintainer Tatu Saloranta (commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7) and shipped in the upstream release before TuxCare's initial onboarding commit (88c055ec918e31e2f57c9d1fe7320f22c2932949).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "Target jackson-databind 2.20.1-tuxcare.4 is NOT vulnerable to CVE-2020-24616. The fix preventing deserialization of br.com.anteros.dbcp.AnterosDBCPDataSource was already present in upstream version 2.20.1 when TuxCare onboarded it. The blacklist entry exists at SubTypeValidator.java:147, blocking the deserialization gadget. The fix was authored by upstream maintainer Tatu Saloranta (commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7) and shipped in the upstream release before TuxCare's initial onboarding commit (88c055ec918e31e2f57c9d1fe7320f22c2932949).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:18:09.376674+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 concerns a deserialization gadget (com.pastdev.httpcomponents.configuration.JndiConfiguration) that enables JNDI injection attacks. The upstream fix (commit 6cc9f1a1af, July 2020) added this class to jackson-databind's deserialization blocklist in SubTypeValidator.java. Version 2.20.1 was released upstream with this fix already present. TuxCare onboarded the patched 2.20.1 release (commit 88c055ec91), so the target version 2.20.1-tuxcare.4 has never contained the vulnerable code pattern. The fix is present at SubTypeValidator.java:210 and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 concerns a deserialization gadget (com.pastdev.httpcomponents.configuration.JndiConfiguration) that enables JNDI injection attacks. The upstream fix (commit 6cc9f1a1af, July 2020) added this class to jackson-databind's deserialization blocklist in SubTypeValidator.java. Version 2.20.1 was released upstream with this fix already present. TuxCare onboarded the patched 2.20.1 release (commit 88c055ec91), so the target version 2.20.1-tuxcare.4 has never contained the vulnerable code pattern. The fix is present at SubTypeValidator.java:210 and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind's DOMDeserializer) is NOT present in version 2.20.1. The upstream fix was already included in the release that TuxCare onboarded. The fix adds two XML parser security features (disallow DOCTYPE declarations and prevent external DTD loading) that block XXE attacks. Fix commit 612f971b78 authored by Tatu Saloranta (upstream maintainer) shipped in upstream release 2.20.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind's DOMDeserializer) is NOT present in version 2.20.1. The upstream fix was already included in the release that TuxCare onboarded. The fix adds two XML parser security features (disallow DOCTYPE declarations and prevent external DTD loading) that block XXE attacks. Fix commit 612f971b78 authored by Tatu Saloranta (upstream maintainer) shipped in upstream release 2.20.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:23:14.032161+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 does NOT affect jackson-databind 2.20.1-tuxcare.4. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream release 2.20.1 when TuxCare onboarded it (first TuxCare commit 88c055ec91). The blocklist entries are active at SubTypeValidator.java:217-218, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 does NOT affect jackson-databind 2.20.1-tuxcare.4. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in upstream release 2.20.1 when TuxCare onboarded it (first TuxCare commit 88c055ec91). The blocklist entries are active at SubTypeValidator.java:217-218, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:09.053481+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which could be exploited as deserialization gadgets. The target version 2.20.1-tuxcare.3 is NOT affected because the upstream fix (commit 41b8bdb5cc from December 2020) was already included in the upstream version 2.20.1 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java at lines 217-218, and the validation mechanism actively prevents deserialization of these dangerous classes through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource, which could be exploited as deserialization gadgets. The target version 2.20.1-tuxcare.3 is NOT affected because the upstream fix (commit 41b8bdb5cc from December 2020) was already included in the upstream version 2.20.1 release that TuxCare onboarded. The blocklist entries are present in SubTypeValidator.java at lines 217-218, and the validation mechanism actively prevents deserialization of these dangerous classes through BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:55:46.062749+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves deserialization of the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class for remote code execution. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which is actively enforced during bean deserialization. This fix was already present in upstream release 2.20.1 before TuxCare onboarded the version (first TuxCare commit: 88c055ec918e31e2f57c9d1fe7320f22c2932949 by evasilev@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves deserialization of the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class for remote code execution. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which is actively enforced during bean deserialization. This fix was already present in upstream release 2.20.1 before TuxCare onboarded the version (first TuxCare commit: 88c055ec918e31e2f57c9d1fe7320f22c2932949 by evasilev@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.20.1-tuxcare.4 is not affected by CVE-2020-36179. The upstream fix (commit 3ded28aece) was authored by Tatu Saloranta and shipped with the upstream release 2.20.1, which TuxCare later onboarded. All five DriverAdapterCPDS class names that the patch adds to the deserialization blacklist are present in SubTypeValidator.java (lines 123, 193, 219, 228, 234). The vulnerable pattern does not exist in this version because the fix was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "The target jackson-databind version 2.20.1-tuxcare.4 is not affected by CVE-2020-36179. The upstream fix (commit 3ded28aece) was authored by Tatu Saloranta and shipped with the upstream release 2.20.1, which TuxCare later onboarded. All five DriverAdapterCPDS class names that the patch adds to the deserialization blacklist are present in SubTypeValidator.java (lines 123, 193, 219, 228, 234). The vulnerable pattern does not exist in this version because the fix was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:42:13.542842+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The upstream fix (commit 3ded28aece by Tatu Saloranta) that blocks this class in SubTypeValidator was already present in the upstream 2.20.1 release when TuxCare onboarded it. The target code at SubTypeValidator.java:219 explicitly blocks deserialization of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related variants, preventing the attack chain from Input (JSON with polymorphic type info) to Goal (arbitrary code execution via gadget chain).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The upstream fix (commit 3ded28aece by Tatu Saloranta) that blocks this class in SubTypeValidator was already present in the upstream 2.20.1 release when TuxCare onboarded it. The target code at SubTypeValidator.java:219 explicitly blocks deserialization of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related variants, preventing the attack chain from Input (JSON with polymorphic type info) to Goal (arbitrary code execution via gadget chain).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:45:42.706698+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.20.1-tuxcare.4 is NOT affected by CVE-2020-36181. The fix for this vulnerability (blocking org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS from polymorphic deserialization) was already present in the upstream jackson-databind 2.20.1 release when TuxCare onboarded it. The fix commit (3ded28aece694d0df39c9f0fa1ff385b14a8656b) was authored by upstream maintainer Tatu Saloranta and first appeared in versions 2.9.10.8 and 2.12.1. Since version 2.20.1 is much newer than the affected versions (2.x before 2.9.10.8), the vulnerable code pattern does not exist in this target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target jackson-databind version 2.20.1-tuxcare.4 is NOT affected by CVE-2020-36181. The fix for this vulnerability (blocking org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS from polymorphic deserialization) was already present in the upstream jackson-databind 2.20.1 release when TuxCare onboarded it. The fix commit (3ded28aece694d0df39c9f0fa1ff385b14a8656b) was authored by upstream maintainer Tatu Saloranta and first appeared in versions 2.9.10.8 and 2.12.1. Since version 2.20.1 is much newer than the affected versions (2.x before 2.9.10.8), the vulnerable code pattern does not exist in this target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:13:47.994162+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves unsafe deserialization of DBCP-related gadget classes (specifically org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes) that could lead to remote code execution. The upstream fix was applied by Tatu Saloranta (upstream maintainer) in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b (\"Fixed #3004\") on Dec 31, 2020, which added these classes to SubTypeValidator's deserialization blocklist. This fix was already present in upstream release 2.20.1 before TuxCare onboarded it on commit 88c055ec918e31. The target's SubTypeValidator.java contains all required blocklist entries at lines 123, 193, 219, 228, and 234, and BeanDeserializerFactory.java enforces the blocklist at line 1121 by calling SubTypeValidator.instance().validateSubType(), which throws JsonMappingException for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.20.1-tuxcare.4. The vulnerability involves unsafe deserialization of DBCP-related gadget classes (specifically org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes) that could lead to remote code execution. The upstream fix was applied by Tatu Saloranta (upstream maintainer) in commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b (\"Fixed #3004\") on Dec 31, 2020, which added these classes to SubTypeValidator's deserialization blocklist. This fix was already present in upstream release 2.20.1 before TuxCare onboarded it on commit 88c055ec918e31. The target's SubTypeValidator.java contains all required blocklist entries at lines 123, 193, 219, 228, and 234, and BeanDeserializerFactory.java enforces the blocklist at line 1121 by calling SubTypeValidator.instance().validateSubType(), which throws JsonMappingException for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:22:01.951264+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns the deserialization of the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool which could lead to remote code execution via JNDI injection. The fix (blocking this class from deserialization by adding it to SubTypeValidator's denylist) was already present in the upstream release 2.20.1, committed by upstream maintainer Tatu Saloranta on Dec 31, 2020. The fix is found at line 243 of SubTypeValidator.java. TuxCare onboarded version 2.20.1 with this protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns the deserialization of the gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool which could lead to remote code execution via JNDI injection. The fix (blocking this class from deserialization by adding it to SubTypeValidator's denylist) was already present in the upstream release 2.20.1, committed by upstream maintainer Tatu Saloranta on Dec 31, 2020. The fix is found at line 243 of SubTypeValidator.java. TuxCare onboarded version 2.20.1 with this protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for deserialization gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository at version 2.20.1 (HEAD: edf3fdd80d) already contains the upstream fix (commit 567194c53a by tatu.saloranta@iki.fi) which was shipped in the upstream release 2.20.1 before TuxCare onboarding. The vulnerable classes are present in the blacklist at SubTypeValidator.java lines 235-236, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for deserialization gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository at version 2.20.1 (HEAD: edf3fdd80d) already contains the upstream fix (commit 567194c53a by tatu.saloranta@iki.fi) which was shipped in the upstream release 2.20.1 before TuxCare onboarding. The vulnerable classes are present in the blacklist at SubTypeValidator.java lines 235-236, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.20.1. The fix that blacklists the gadget classes `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource` was already included in the upstream jackson-databind 2.20.1 release that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 567194c53ae91f0a14dc27239afb739b1c10448a, which predates the TuxCare onboarding commit 88c055ec91.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.20.1. The fix that blacklists the gadget classes `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource` was already included in the upstream jackson-databind 2.20.1 release that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 567194c53ae91f0a14dc27239afb739b1c10448a, which predates the TuxCare onboarding commit 88c055ec91.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:38:19.408252+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.20.1-tuxcare.4 is not affected by CVE-2020-36186. The vulnerable gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) are blocked by an upstream fix that shipped in the jackson-databind 2.20.1 release. The fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This defense was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3e8fa3beea, which was already present when TuxCare onboarded version 2.20.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "Target jackson-databind 2.20.1-tuxcare.4 is not affected by CVE-2020-36186. The vulnerable gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) are blocked by an upstream fix that shipped in the jackson-databind 2.20.1 release. The fix adds these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This defense was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 3e8fa3beea, which was already present when TuxCare onboarded version 2.20.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:49:46.568438+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version 2.20.1-tuxcare.4 contains the upstream fix (commit 3e8fa3beea) that adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.20.1 release when TuxCare onboarded it. The blocklist prevents deserialization of these dangerous gadget classes, eliminating the vulnerability. The defense is active by default and cannot be bypassed without code modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version 2.20.1-tuxcare.4 contains the upstream fix (commit 3e8fa3beea) that adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.20.1 release when TuxCare onboarded it. The blocklist prevents deserialization of these dangerous gadget classes, eliminating the vulnerability. The defense is active by default and cannot be bypassed without code modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.20.1-tuxcare.4. The upstream fix (commit 33d96c13 by Tatu Saloranta on Dec 26, 2020) was already included in the upstream 2.20.1 release before TuxCare onboarded it. The fix adds com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in SubTypeValidator.java (lines 223-224), preventing their deserialization and blocking the JNDI-based RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.20.1-tuxcare.4. The upstream fix (commit 33d96c13 by Tatu Saloranta on Dec 26, 2020) was already included in the upstream 2.20.1 release before TuxCare onboarded it. The fix adds com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in SubTypeValidator.java (lines 223-224), preventing their deserialization and blocking the JNDI-based RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:13.759745+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5. The target version 2.20.1-tuxcare.3 contains the upstream fix (commit 33d96c13fe) which was included in jackson-databind-2.12.1 and all subsequent versions. The fix adds com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 223-224). The fix was already present in the upstream 2.20.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5. The target version 2.20.1-tuxcare.3 contains the upstream fix (commit 33d96c13fe) which was included in jackson-databind-2.12.1 and all subsequent versions. The fix adds com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 223-224). The fix was already present in the upstream 2.20.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:47.001354+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 describes a stack overflow DoS vulnerability caused by deeply nested JSON objects. The upstream jackson-databind project fixed this through an architectural change: replacing the recursive Vanilla deserializer with UntypedObjectDeserializerNR, a non-recursive (iterative) implementation that uses a heap-based Scope chain instead of recursive method calls. This fix was shipped in upstream release 2.20.1 which TuxCare onboarded. The vulnerable recursive code pattern is not present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 describes a stack overflow DoS vulnerability caused by deeply nested JSON objects. The upstream jackson-databind project fixed this through an architectural change: replacing the recursive Vanilla deserializer with UntypedObjectDeserializerNR, a non-recursive (iterative) implementation that uses a heap-based Scope chain instead of recursive method calls. This fix was shipped in upstream release 2.20.1 which TuxCare onboarded. The vulnerable recursive code pattern is not present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.20.1-tuxcare.4 is NOT affected by CVE-2020-8840. The vulnerability pattern (deserialization of org.apache.xbean.propertyeditor.JndiConverter leading to JNDI injection) is not present because the upstream vendor's fix was already included in the release version onboarded by TuxCare. The fix commit 9bb52c7122 by Tatu Saloranta added JndiConverter to the blocklist in SubTypeValidator.java and was already present in upstream version 2.9.10.5 before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target repository jackson-databind 2.20.1-tuxcare.4 is NOT affected by CVE-2020-8840. The vulnerability pattern (deserialization of org.apache.xbean.propertyeditor.JndiConverter leading to JNDI injection) is not present because the upstream vendor's fix was already included in the release version onboarded by TuxCare. The fix commit 9bb52c7122 by Tatu Saloranta added JndiConverter to the blocklist in SubTypeValidator.java and was already present in upstream version 2.9.10.5 before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.20.1. The vulnerability concerns deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig gadget class. The upstream fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.20.1 when TuxCare onboarded it in July 2026. The target is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.20.1. The vulnerability concerns deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig gadget class. The upstream fix (commit 9f4e97019fb0dd836533d0b6198c88787e235ae2) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream release 2.20.1 when TuxCare onboarded it in July 2026. The target is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.20.1-tuxcare.4 is not affected by CVE-2020-9547. The vulnerability was fixed in upstream version 2.7.9.7 (Feb 29, 2020) by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to Jackson's deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release that TuxCare onboarded, as confirmed by commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb being an ancestor of the first TuxCare commit. The target version 2.20.1 is significantly newer than the fixed version 2.7.9.7 and contains the complete protection against this deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "The target jackson-databind 2.20.1-tuxcare.4 is not affected by CVE-2020-9547. The vulnerability was fixed in upstream version 2.7.9.7 (Feb 29, 2020) by adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to Jackson's deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release that TuxCare onboarded, as confirmed by commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb being an ancestor of the first TuxCare commit. The target version 2.20.1 is significantly newer than the fixed version 2.7.9.7 and contains the complete protection against this deserialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:19:28.543087+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 9f4e97019f by Tatu Saloranta, dated Feb 29, 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped with upstream jackson-databind and was included when TuxCare onboarded version 2.20.1 (commit 88c055ec91). The SubTypeValidator actively blocks deserialization of this gadget class at line 269, throwing a JsonMappingException before any harmful deserialization can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 9f4e97019f by Tatu Saloranta, dated Feb 29, 2020) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix shipped with upstream jackson-databind and was included when TuxCare onboarded version 2.20.1 (commit 88c055ec91). The SubTypeValidator actively blocks deserialization of this gadget class at line 269, throwing a JsonMappingException before any harmful deserialization can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:17:20.138118+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind before 2.9.10.7, involving deserialization gadget exploitation via javax.swing classes. The target version 2.20.1-tuxcare.4 is NOT affected because the upstream fix (adding javax.swing.JTextPane and JEditorPane to the deserialization blocklist) was already present in the upstream release 2.20.1 when TuxCare onboarded it. The fix commit 7dbf51bf78 by upstream maintainer Tatu Saloranta predates the first TuxCare commit (88c055ec91 \"Onboard version 2.20.1\"). The vulnerable code pattern does not exist in the target - the defense blocklist at SubTypeValidator.java lines 150-151 prevents instantiation of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 affects jackson-databind before 2.9.10.7, involving deserialization gadget exploitation via javax.swing classes. The target version 2.20.1-tuxcare.4 is NOT affected because the upstream fix (adding javax.swing.JTextPane and JEditorPane to the deserialization blocklist) was already present in the upstream release 2.20.1 when TuxCare onboarded it. The fix commit 7dbf51bf78 by upstream maintainer Tatu Saloranta predates the first TuxCare commit (88c055ec91 \"Onboard version 2.20.1\"). The vulnerable code pattern does not exist in the target - the defense blocklist at SubTypeValidator.java lines 150-151 prevents instantiation of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is not present in jackson-databind 2.20.1. The vulnerability affects versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The upstream fix (commit 3ccde7d938) by Tatu Saloranta was already included in the upstream 2.20.1 release that TuxCare onboarded. The fix introduces a 100k allocation cap and chunked reading to prevent DoS via malicious JDK serialization of JsonNode objects with inflated declared lengths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 is not present in jackson-databind 2.20.1. The vulnerability affects versions 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1. The upstream fix (commit 3ccde7d938) by Tatu Saloranta was already included in the upstream 2.20.1 release that TuxCare onboarded. The fix introduces a 100k allocation cap and chunked reading to prevent DoS via malicious JDK serialization of JsonNode objects with inflated declared lengths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.20.1 is NOT affected by CVE-2022-42003. The upstream fix for preventing resource exhaustion from deeply nested wrapper arrays was already included in the Jackson 2.20.1 release before TuxCare onboarded it. Version 2.20.1 is significantly newer than the affected versions listed in the CVE (2.12.7.1, 2.13.4.2) and includes all fixes from both the 2.12.x and 2.13.x branches. The fix adds nested array depth validation in StdDeserializer (for all primitive types) and BeanDeserializer, rejecting inputs like [[[123]]] when UNWRAP_SINGLE_VALUE_ARRAYS is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "Target version 2.20.1 is NOT affected by CVE-2022-42003. The upstream fix for preventing resource exhaustion from deeply nested wrapper arrays was already included in the Jackson 2.20.1 release before TuxCare onboarded it. Version 2.20.1 is significantly newer than the affected versions listed in the CVE (2.12.7.1, 2.13.4.2) and includes all fixes from both the 2.12.x and 2.13.x branches. The fix adds nested array depth validation in StdDeserializer (for all primitive types) and BeanDeserializer, rejecting inputs like [[[123]]] when UNWRAP_SINGLE_VALUE_ARRAYS is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:10.906994+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns deeply nested arrays causing resource exhaustion in BeanDeserializer._deserializeFromArray when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by tatu.saloranta@iki.fi) was already present when TuxCare onboarded version 2.20.1. The defense code at BeanDeserializer.java:663-671 rejects nested arrays by checking for a second START_ARRAY token after unwrapping the first layer, exactly as specified in the patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.20.1-tuxcare.4. The vulnerability concerns deeply nested arrays causing resource exhaustion in BeanDeserializer._deserializeFromArray when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by tatu.saloranta@iki.fi) was already present when TuxCare onboarded version 2.20.1. The defense code at BeanDeserializer.java:663-671 rejects nested arrays by checking for a second START_ARRAY token after unwrapping the first layer, exactly as specified in the patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T20:21:46.051659+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.20.1 is NOT affected by CVE-2026-50193. The vulnerability (stack overflow from deeply nested JsonNode serialization) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec (Fix #3447) authored by Tatu Saloranta. This fix shipped in the upstream 2.20.1 release before TuxCare onboarding. The target code contains the iterative serialization implementation ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind version 2.20.1 is NOT affected by CVE-2026-50193. The vulnerability (stack overflow from deeply nested JsonNode serialization) was fixed in upstream version 2.14.0 via commit a1fa4ae4ec (Fix #3447) authored by Tatu Saloranta. This fix shipped in the upstream 2.20.1 release before TuxCare onboarding. The target code contains the iterative serialization implementation ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T03:20:00.117354+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.20.1 is NOT AFFECTED. The vulnerability (CVE-2026-54516) was architecturally introduced in version 2.21.0, not present in 2.20.1. The target unconditionally skips all properties in _ignoredPropertyNames during _renameProperties, preventing renamed properties with @JsonIgnore'd setters from being deserialized via field access. The vulnerable code pattern (conditional logic allow...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "impact_statement": "not_affected \u2014 Target version 2.20.1 is NOT AFFECTED. The vulnerability (CVE-2026-54516) was architecturally introduced in version 2.21.0, not present in 2.20.1. The target unconditionally skips all properties in _ignoredPropertyNames during _renameProperties, preventing renamed properties with @JsonIgnore'd setters from being deserialized via field access. The vulnerable code pattern (conditional logic allow..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "action_statement": "Vulnerability CVE-2026-54518 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:16:00.139442+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.20.1-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T14:15:28.606170+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.20.1-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}