{ "@id": "urn:uuid:ec7b9aa6-636e-4591-983b-175d5b85ab3f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T12:48:58.346399+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2017-15095 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-15095" }, "action_statement": "Vulnerability CVE-2017-15095 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2017-17485 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-17485" }, "action_statement": "Vulnerability CVE-2017-17485 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.6.7.3 (com.fasterxml.jackson.core:jackson-databind) \u2014 same product as the CVE, so not a false positive. CVE-2017-7525 (polymorphic deserialization RCE, databind#1599) was fixed upstream in 2.6.7.1; the target at 2.6.7.3 is a later release that already contains that fix.\n\nThe defense is fully present in src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java: a static blacklist DEFAULT_NO_DESER_CLASS_NAMES (lines 48-142) holding the original #1599 gadget classes (org.apache.commons.collections[4].functors.InvokerTransformer/InstantiateTransformer, org.codehaus.groovy.runtime.ConvertedClosure/MethodClosure, org.springframework.beans.factory.ObjectFactory, com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl) plus many later additions; assigned to _cfgIllegalClassNames (line 148); and checkIllegalTypes() (line 948) invoked unconditionally at line 248 inside createBeanDeserializer BEFORE buildBeanDeserializer, throwing \"Illegal type (...) to deserialize: prevented for security reasons\" for any blacklisted raw type. This exactly matches the vendor patch.\n\ngit blame proves the entire defense (blacklist lines 53-60, checkIllegalTypes method, call site) was authored by Tatu Saloranta \u2014 the FasterXML upstream maintainer \u2014 in commit fa87c1ddb \"Backport #1599 in 2.6.x\" (2017-07-10), one of the input vendor patch commits. It reached the target only through the wholesale \"Onboard version 2.6.7.3\" merge, not a TuxCare CVE backport. Verdict: not_affected (upstream/vendor fix already in the shipped version); the vulnerable pre-fix pattern is absent from HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.6.7.3 (com.fasterxml.jackson.core:jackson-databind) \u2014 same product as the CVE, so not a false positive. CVE-2017-7525 (polymorphic deserialization RCE, databind#1599) was fixed upstream in 2.6.7.1; the target at 2.6.7.3 is a later release that already contains that fix.\n\nThe defense is fully present in src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java: a static blacklist DEFAULT_NO_DESER_CLASS_NAMES (lines 48-142) holding the original #1599 gadget classes (org.apache.commons.collections[4].functors.InvokerTransformer/InstantiateTransformer, org.codehaus.groovy.runtime.ConvertedClosure/MethodClosure, org.springframework.beans.factory.ObjectFactory, com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl) plus many later additions; assigned to _cfgIllegalClassNames (line 148); and checkIllegalTypes() (line 948) invoked unconditionally at line 248 inside createBeanDeserializer BEFORE buildBeanDeserializer, throwing \"Illegal type (...) to deserialize: prevented for security reasons\" for any blacklisted raw type. This exactly matches the vendor patch.\n\ngit blame proves the entire defense (blacklist lines 53-60, checkIllegalTypes method, call site) was authored by Tatu Saloranta \u2014 the FasterXML upstream maintainer \u2014 in commit fa87c1ddb \"Backport #1599 in 2.6.x\" (2017-07-10), one of the input vendor patch commits. It reached the target only through the wholesale \"Onboard version 2.6.7.3\" merge, not a TuxCare CVE backport. Verdict: not_affected (upstream/vendor fix already in the shipped version); the vulnerable pre-fix pattern is absent from HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11307" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12022" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as the issue was introduced in 2.7.0", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12023" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as the issue was introduced in 2.7.0" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind (com.fasterxml.jackson.core) at upstream version 2.6.7.3 \u2014 the exact upstream fixed version named in CVE-2018-14718. The vendor patch (commit 87d29af25, \"Fix #2097 for 2.6.7.2\", CVE-2018-14718..14721) adds four gadget class names to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in BeanDeserializerFactory.java, including the slf4j-ext class `org.slf4j.ext.EventData`. That exact line is present in the target at BeanDeserializerFactory.java:90 (with the other three at 91-93), and the deny-list is enforced: createBeanDeserializer calls checkIllegalTypes() (line 248) before buildBeanDeserializer, and checkIllegalTypes throws \"Illegal type (...) to deserialize: prevented for security reasons\" when the resolved class name is in _cfgIllegalClassNames (lines 956-960). So attacker JSON naming org.slf4j.ext.EventData as a polymorphic subtype is rejected before instantiation \u2014 the Brief's Goal is unreachable. `git log -S \"org.slf4j.ext.EventData\"` attributes the line to upstream commit 87d29af25 by tatu.saloranta@iki.fi; that commit is an ancestor of the pre-onboard tuxcare tip ec1adf8c72 (upstream 2.6.7.3 release), so the fix is upstream-authored and already present, not a TuxCare backport. Verdict: not_affected (upstream vendor fix already shipped). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14718" }, "impact_statement": "not_affected \u2014 Target is jackson-databind (com.fasterxml.jackson.core) at upstream version 2.6.7.3 \u2014 the exact upstream fixed version named in CVE-2018-14718. The vendor patch (commit 87d29af25, \"Fix #2097 for 2.6.7.2\", CVE-2018-14718..14721) adds four gadget class names to the DEFAULT_NO_DESER_CLASS_NAMES deny-list in BeanDeserializerFactory.java, including the slf4j-ext class `org.slf4j.ext.EventData`. That exact line is present in the target at BeanDeserializerFactory.java:90 (with the other three at 91-93), and the deny-list is enforced: createBeanDeserializer calls checkIllegalTypes() (line 248) before buildBeanDeserializer, and checkIllegalTypes throws \"Illegal type (...) to deserialize: prevented for security reasons\" when the resolved class name is in _cfgIllegalClassNames (lines 956-960). So attacker JSON naming org.slf4j.ext.EventData as a polymorphic subtype is rejected before instantiation \u2014 the Brief's Goal is unreachable. `git log -S \"org.slf4j.ext.EventData\"` attributes the line to upstream commit 87d29af25 by tatu.saloranta@iki.fi; that commit is an ancestor of the pre-onboard tuxcare tip ec1adf8c72 (upstream 2.6.7.3 release), so the fix is upstream-authored and already present, not a TuxCare backport. Verdict: not_affected (upstream vendor fix already shipped). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2018-14719 is not exploitable in jackson-databind 2.6.7.3. The BlazeDS gadget flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor is present in the deserialization denylist (BeanDeserializerFactory.java:91, DEFAULT_NO_DESER_CLASS_NAMES) and is enforced: checkIllegalTypes() (lines 948-962) throws for any denylisted raw class and is invoked from createBeanDeserializer() at line 248, before the bean deserializer is built. git blame attributes line 91 to upstream commit 87d29af25e (\"Fix #2097 for 2.6.7.2\", Tatu Saloranta , 2018-08-16), an ancestor of HEAD \u2014 i.e. the fix was inherited from upstream, not backported by TuxCare. Labelled not_affected rather than already_fixed because already_fixed asserts CloudLinux authorship; the only CloudLinux commit on the ancestry path is the onboarding merge 8a8a179ff, which does not introduce the fix. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; Opus returned already_fixed via the A2 rung and was corrected to not_affected on review]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14719" }, "impact_statement": "not_affected \u2014 CVE-2018-14719 is not exploitable in jackson-databind 2.6.7.3. The BlazeDS gadget flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor is present in the deserialization denylist (BeanDeserializerFactory.java:91, DEFAULT_NO_DESER_CLASS_NAMES) and is enforced: checkIllegalTypes() (lines 948-962) throws for any denylisted raw class and is invoked from createBeanDeserializer() at line 248, before the bean deserializer is built. git blame attributes line 91 to upstream commit 87d29af25e (\"Fix #2097 for 2.6.7.2\", Tatu Saloranta , 2018-08-16), an ancestor of HEAD \u2014 i.e. the fix was inherited from upstream, not backported by TuxCare. Labelled not_affected rather than already_fixed because already_fixed asserts CloudLinux authorship; the only CloudLinux commit on the ancestry path is the onboarding merge 8a8a179ff, which does not introduce the fix. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; Opus returned already_fixed via the A2 rung and was corrected to not_affected on review]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is higher than upstream fix version - 2.6.7.2", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14720" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is higher than upstream fix version - 2.6.7.2" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.6.7.3 (product matches the CVE \u2014 not a false positive). CVE-2018-14721 is a polymorphic-deserialization blacklist gap: the SSRF gadget class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl was not blocked from default-typing deserialization. The vendor fix (upstream commit 87d29af, \"Fix #2097 for 2.6.7.2\") adds that class name to the deny-list in BeanDeserializerFactory.java. The target ALREADY contains this fix: the class is on the DEFAULT_NO_DESER_CLASS_NAMES set at BeanDeserializerFactory.java:93, and the set is enforced by checkIllegalTypes() (lines 948-961) which is invoked from buildBeanDeserializer() at line 248 and throws \"prevented for security reasons\" for any deny-listed type. So the vulnerable pattern (missing deny-list entry) is not present in HEAD. Attribution: the fix line was added by commit 87d29af \u2014 the exact SHA of the vendor patch URL \u2014 authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), part of upstream's own 2.6.7.2 micro-release. It is contained in upstream release tags and present in the merge-base of TuxCare's onboarding merge, so it was inherited from upstream, not backported by TuxCare. Author domain is not in the TuxCare/CloudLinux allowlist. Verdict: not_affected (upstream/vendor fix already baked into the shipped version), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14721" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.6.7.3 (product matches the CVE \u2014 not a false positive). CVE-2018-14721 is a polymorphic-deserialization blacklist gap: the SSRF gadget class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl was not blocked from default-typing deserialization. The vendor fix (upstream commit 87d29af, \"Fix #2097 for 2.6.7.2\") adds that class name to the deny-list in BeanDeserializerFactory.java. The target ALREADY contains this fix: the class is on the DEFAULT_NO_DESER_CLASS_NAMES set at BeanDeserializerFactory.java:93, and the set is enforced by checkIllegalTypes() (lines 948-961) which is invoked from buildBeanDeserializer() at line 248 and throws \"prevented for security reasons\" for any deny-listed type. So the vulnerable pattern (missing deny-list entry) is not present in HEAD. Attribution: the fix line was added by commit 87d29af \u2014 the exact SHA of the vendor patch URL \u2014 authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), part of upstream's own 2.6.7.2 micro-release. It is contained in upstream release tags and present in the merge-base of TuxCare's onboarding merge, so it was inherited from upstream, not backported by TuxCare. Author domain is not in the TuxCare/CloudLinux allowlist. Verdict: not_affected (upstream/vendor fix already baked into the shipped version), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is higher than last affected version - 2.6.7.2", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19360" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is higher than last affected version - 2.6.7.2" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is higher than last affected version - 2.6.7.2", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19361" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is higher than last affected version - 2.6.7.2" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-19362" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-5968" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2018-7489 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" }, "action_statement": "Vulnerability CVE-2018-7489 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-12086 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" }, "action_statement": "Vulnerability CVE-2019-12086 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T18:28:37.464094+00:00", "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.6.7.3-tuxcare.4. The upstream fix (blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource) was already included in the upstream release 2.6.7.3 before TuxCare onboarded it. The vulnerable polymorphic deserialization gadget is blocked by SubTypeValidator line 93.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12384" }, "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.6.7.3-tuxcare.4. The upstream fix (blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource) was already included in the upstream release 2.6.7.3 before TuxCare onboarded it. The vulnerable polymorphic deserialization gadget is blocked by SubTypeValidator line 93." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-12814 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" }, "action_statement": "Vulnerability CVE-2019-12814 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14379" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "Jackson Databind 2.6.7.3 is not vulnerable as it is equal to upstream fix version - 2.6.7.3" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-16335 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" }, "action_statement": "Vulnerability CVE-2019-16335 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-03T15:02:41.455639+00:00", "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing attackers to instantiate dangerous classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, com.p6spy.engine.spy.P6DataSource) for remote code execution. The target repository (jackson-databind 2.6.7.3-tuxcare.4) is NOT AFFECTED because the upstream fix blocking these classes was already present in the upstream release 2.6.7.3 that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 124-127) prevents deserialization of all three vulnerable classes. The fix was authored by upstream maintainer Tatu Saloranta (commit a3939d36ed, Oct 15 2019) and shipped with the upstream release before TuxCare's onboarding (commit aacdbb9c8e).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16942" }, "impact_statement": "CVE-2019-16942 affects jackson-databind's polymorphic deserialization when Default Typing is enabled, allowing attackers to instantiate dangerous classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource, com.p6spy.engine.spy.P6DataSource) for remote code execution. The target repository (jackson-databind 2.6.7.3-tuxcare.4) is NOT AFFECTED because the upstream fix blocking these classes was already present in the upstream release 2.6.7.3 that TuxCare onboarded. The blocklist in SubTypeValidator.java (lines 124-127) prevents deserialization of all three vulnerable classes. The fix was authored by upstream maintainer Tatu Saloranta (commit a3939d36ed, Oct 15 2019) and shipped with the upstream release before TuxCare's onboarding (commit aacdbb9c8e).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-17267 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" }, "action_statement": "Vulnerability CVE-2019-17267 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-09T14:28:44.120596+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-10T11:07:00.028868+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.6.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-09T14:28:44.120596+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-09T14:28:44.120596+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-12T12:48:58.346399+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-06T18:52:00.040792+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-02T19:39:08.428117+00:00", "status_notes": "Vulnerability CVE-2026-19032 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Jackson-databind 2.6.7.3 is not affected by CVE-2026-19032 because it does not include java.nio.file.Path deserialization support. Path deserialization (NioPathDeserializer) was first introduced in version 2.8.0 (May 2016), which is after this 2.6.7.3 release. The vulnerable code path that processes URI schemes through ServiceLoader<FileSystemProvider> does not exist in this version. TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-19032" }, "impact_statement": "not_affected \u2014 Jackson-databind 2.6.7.3 is not affected by CVE-2026-19032 because it does not include java.nio.file.Path deserialization support. Path deserialization (NioPathDeserializer) was first introduced in version 2.8.0 (May 2016), which is after this 2.6.7.3 release. The vulnerable code path that processes URI schemes through ServiceLoader<FileSystemProvider> does not exist in this version. TuxC..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Version 2.6.7.3 is not affected by CVE-2026-54512. This vulnerability is specific to PolymorphicTypeValidator (PTV), a security mechanism introduced in jackson-databind 2.10.0 to validate polymorphic deserialization. The CVE describes a bypass where PTV validates the raw container class (e.g., ArrayList) but fails to validate type parameters (e.g., ), allowing attackers to smuggle denied classes. Version 2.6.7.3 predates PTV by several major versions\u2014PTV and its associated allow-list mechanism do not exist in this codebase. While 2.6.7.3 does process generic type IDs via ClassNameIdResolver without any validation, the specific vulnerability (bypassing a PTV-configured allow-list) cannot occur without the PTV mechanism itself.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.6.7.3 is not affected by CVE-2026-54512. This vulnerability is specific to PolymorphicTypeValidator (PTV), a security mechanism introduced in jackson-databind 2.10.0 to validate polymorphic deserialization. The CVE describes a bypass where PTV validates the raw container class (e.g., ArrayList) but fails to validate type parameters (e.g., ), allowing attackers to smuggle denied classes. Version 2.6.7.3 predates PTV by several major versions\u2014PTV and its associated allow-list mechanism do not exist in this codebase. While 2.6.7.3 does process generic type IDs via ClassNameIdResolver without any validation, the specific vulnerability (bypassing a PTV-configured allow-list) cannot occur without the PTV mechanism itself." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-54515 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.6.7.3 is not affected by CVE-2026-54515. The vulnerability requires the @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) feature and associated case-insensitivity rebuild logic in BeanDeserializerBase.createContextual(), which were introduced in version 2.8.0. This feature does not exist in version 2.6.7.3 - the necessary enum values, methods (withCaseInsensitivity, _handleByNameInclus...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54515" }, "impact_statement": "not_affected \u2014 Version 2.6.7.3 is not affected by CVE-2026-54515. The vulnerability requires the @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) feature and associated case-insensitivity rebuild logic in BeanDeserializerBase.createContextual(), which were introduced in version 2.8.0. This feature does not exist in version 2.6.7.3 - the necessary enum values, methods (withCaseInsensitivity, _handleByNameInclus..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-09T14:29:00.217724+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.6.7.3-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-03T02:00:46.216689+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54518 specifically affects @JsonUnwrapped on creator parameters, a feature that does not exist in jackson-databind version 2.6.7.3. The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() was introduced in commit 502fe888 (November 2024), approximately 8 years after the target version 2.6.7.3 was released. The target contains a failing test (TestUnwrappedWith...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 CVE-2026-54518 specifically affects @JsonUnwrapped on creator parameters, a feature that does not exist in jackson-databind version 2.6.7.3. The vulnerable method UnwrappedPropertyHandler.processUnwrappedCreatorProperties() was introduced in commit 502fe888 (November 2024), approximately 8 years after the target version 2.6.7.3 was released. The target contains a failing test (TestUnwrappedWith..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-03T01:38:00.104929+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 specifically affects Java Record deserialization when combining @JsonIgnore with PropertyNamingStrategy. The target version (jackson-databind 2.6.7.3) predates Java Records by 4-5 years and contains no Record support code. For regular POJOs, @JsonIgnore properties are removed from the property map before PropertyNamingStrategy renaming occurs (POJOPropertiesCollector.java:672), p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 CVE-2026-59888 specifically affects Java Record deserialization when combining @JsonIgnore with PropertyNamingStrategy. The target version (jackson-databind 2.6.7.3) predates Java Records by 4-5 years and contains no Record support code. For regular POJOs, @JsonIgnore properties are removed from the property map before PropertyNamingStrategy renaming occurs (POJOPropertiesCollector.java:672), p..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:39:00.156443+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-02T20:29:00.092740+00:00", "status_notes": "Vulnerability CVE-2026-83557 does not affect version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-83557 targets DefaultBaseTypeLimitingValidator, a polymorphic type validator class introduced in jackson-databind 2.10+. This class maintains an \"unsafe base types\" denylist and the vulnerability is that java.lang.Comparable is missing from that list. Target version 2.6.7.3-tuxcare.4 predates this architecture entirely\u2014it uses a simpler SubTypeValidator that only blocks specific danger...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-83557" }, "impact_statement": "not_affected \u2014 CVE-2026-83557 targets DefaultBaseTypeLimitingValidator, a polymorphic type validator class introduced in jackson-databind 2.10+. This class maintains an \"unsafe base types\" denylist and the vulnerability is that java.lang.Comparable is missing from that list. Target version 2.6.7.3-tuxcare.4 predates this architecture entirely\u2014it uses a simpler SubTypeValidator that only blocks specific danger..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.6.7.3-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3-tuxcare.4" } } ], "timestamp": "2026-11-01T13:38:43.004573+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.6.7.3-tuxcare.4.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }