{
  "@id": "urn:uuid:090fe859-a511-4863-bc5f-10189abcb0b6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 76,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:23:21.059555+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.9.10.8-tuxcare.2. The vulnerability affects versions prior to 2.8.11 and 2.9.4; the target is at 2.9.10.8, which already contains the upstream fixes. The blacklist in SubTypeValidator includes all dangerous classes added to mitigate this CVE: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and Spring/C3P0 classes (handled via prefix matching). The fixes were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.9.10.8-tuxcare.2. The vulnerability affects versions prior to 2.8.11 and 2.9.4; the target is at 2.9.10.8, which already contains the upstream fixes. The blacklist in SubTypeValidator includes all dangerous classes added to mitigate this CVE: java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and Spring/C3P0 classes (handled via prefix matching). The fixes were authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:43:48.993875+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.8-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version (2.9.10.8) includes the upstream fixes from issues #1737 and #1855 that add comprehensive blacklist protection against deserialization gadgets. The SubTypeValidator class (lines 1-305) contains all required blacklist entries including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and Spring framework superclass pattern matching. The fix was authored by upstream developers (tatu.saloranta@iki.fi, andrew.tolbert@datastax.com) and shipped in the upstream 2.9.10.8 release prior to TuxCare's onboarding commit ae0fed26c6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target version 2.9.10.8-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3. The target version (2.9.10.8) includes the upstream fixes from issues #1737 and #1855 that add comprehensive blacklist protection against deserialization gadgets. The SubTypeValidator class (lines 1-305) contains all required blacklist entries including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader, and Spring framework superclass pattern matching. The fix was authored by upstream developers (tatu.saloranta@iki.fi, andrew.tolbert@datastax.com) and shipped in the upstream 2.9.10.8 release prior to TuxCare's onboarding commit ae0fed26c6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:26:58.411173+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.8-tuxcare.3 is NOT affected by CVE-2017-7525. The vulnerability was fixed in the upstream release via SubTypeValidator, which implements a comprehensive blacklist preventing deserialization of dangerous classes including TemplatesImpl and other gadget classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.9.10.8 before TuxCare onboarded the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target jackson-databind 2.9.10.8-tuxcare.3 is NOT affected by CVE-2017-7525. The vulnerability was fixed in the upstream release via SubTypeValidator, which implements a comprehensive blacklist preventing deserialization of dangerous classes including TemplatesImpl and other gadget classes. This fix was authored by upstream maintainer Tatu Saloranta and shipped in upstream version 2.9.10.8 before TuxCare onboarded the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:11.201920+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.8 is NOT AFFECTED by CVE-2018-11307. The vulnerability (iBatis XPathParser gadget enabling data exfiltration via polymorphic deserialization) was fixed by upstream FasterXML in version 2.9.6. The fix adds org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java. This upstream fix shipped in the 2.9.10.8 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "Target version 2.9.10.8 is NOT AFFECTED by CVE-2018-11307. The vulnerability (iBatis XPathParser gadget enabling data exfiltration via polymorphic deserialization) was fixed by upstream FasterXML in version 2.9.6. The fix adds org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java. This upstream fix shipped in the 2.9.10.8 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:18:37.716688+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.9.6 when Default Typing is enabled. The vulnerability allows attackers to execute arbitrary code by specifying gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in JSON payloads that trigger JNDI/LDAP lookups during deserialization. The target (jackson-databind 2.9.10.8) is NOT AFFECTED because the fix was already present in the upstream 2.9.10.8 release before TuxCare onboarded it. The SubTypeValidator blacklist contains all three gadget classes (lines 67-72), preventing their deserialization with a JsonMappingException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.9.6 when Default Typing is enabled. The vulnerability allows attackers to execute arbitrary code by specifying gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) in JSON payloads that trigger JNDI/LDAP lookups during deserialization. The target (jackson-databind 2.9.10.8) is NOT AFFECTED because the fix was already present in the upstream 2.9.10.8 release before TuxCare onboarded it. The SubTypeValidator blacklist contains all three gadget classes (lines 67-72), preventing their deserialization with a JsonMappingException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:20:17.888209+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.8 is NOT AFFECTED by CVE-2018-12023. The vulnerable pattern (ability to deserialize Oracle JDBC gadget classes oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet for JNDI/LDAP exploitation) is not present because the upstream vendor's fix was already included in the 2.9.10.8 release that TuxCare onboarded. The fix (commit 28badf7ef6 by Tatu Saloranta, June 2018) adds these classes to SubTypeValidator's blacklist, preventing their polymorphic deserialization. This fix was part of the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "Target version 2.9.10.8 is NOT AFFECTED by CVE-2018-12023. The vulnerable pattern (ability to deserialize Oracle JDBC gadget classes oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet for JNDI/LDAP exploitation) is not present because the upstream vendor's fix was already included in the 2.9.10.8 release that TuxCare onboarded. The fix (commit 28badf7ef6 by Tatu Saloranta, June 2018) adds these classes to SubTypeValidator's blacklist, preventing their polymorphic deserialization. This fix was part of the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:07.796693+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.8-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The vulnerability required blocking the org.slf4j.ext.EventData class (and three other classes) from polymorphic deserialization to prevent arbitrary code execution. The fix was already present in the upstream release 2.9.10.8 before TuxCare onboarded it. The blocklist entry preventing deserialization of org.slf4j.ext.EventData is present at line 75 of SubTypeValidator.java, and the validation is enforced on every bean deserialization path through BeanDeserializerFactory line 135. The fix commit (87d29af25e) was authored by upstream maintainer Tatu Saloranta and is an ancestor of TuxCare's first onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10.8-tuxcare.3) is NOT AFFECTED by CVE-2018-14718. The vulnerability required blocking the org.slf4j.ext.EventData class (and three other classes) from polymorphic deserialization to prevent arbitrary code execution. The fix was already present in the upstream release 2.9.10.8 before TuxCare onboarded it. The blocklist entry preventing deserialization of org.slf4j.ext.EventData is present at line 75 of SubTypeValidator.java, and the validation is enforced on every bean deserialization path through BeanDeserializerFactory line 135. The fix commit (87d29af25e) was authored by upstream maintainer Tatu Saloranta and is an ancestor of TuxCare's first onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:59:41.286358+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 concerns polymorphic deserialization of blaze-ds classes (flex.messaging) that could enable arbitrary code execution. The upstream fix (commit 87d29af25e) added flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist in SubTypeValidator. This fix was already present in jackson-databind 2.9.10.8 when TuxCare onboarded it. The target version 2.9.10.8-tuxcare.3 contains this upstream fix at SubTypeValidator.java:76, and the validation is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 concerns polymorphic deserialization of blaze-ds classes (flex.messaging) that could enable arbitrary code execution. The upstream fix (commit 87d29af25e) added flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist in SubTypeValidator. This fix was already present in jackson-databind 2.9.10.8 when TuxCare onboarded it. The target version 2.9.10.8-tuxcare.3 contains this upstream fix at SubTypeValidator.java:76, and the validation is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:07:32.765766+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.9.10.8. The vulnerability was fixed in the upstream version by commit 87d29af25e authored by Tatu Saloranta (upstream maintainer), which added four classes to the polymorphic deserialization blocklist. This fix was already present in version 2.9.10.8 when TuxCare onboarded it. The four blocked classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in SubTypeValidator.java:75-78, and the validation mechanism is actively enforced during polymorphic deserialization through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.9.10.8. The vulnerability was fixed in the upstream version by commit 87d29af25e authored by Tatu Saloranta (upstream maintainer), which added four classes to the polymorphic deserialization blocklist. This fix was already present in version 2.9.10.8 when TuxCare onboarded it. The four blocked classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in SubTypeValidator.java:75-78, and the validation mechanism is actively enforced during polymorphic deserialization through BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of the axis2-jaxws class enabling SSRF attacks. The upstream fix (commit 87d29af25e) added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.9.10.8 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta. The target repository contains the complete fix at SubTypeValidator.java:78, which blocks deserialization of the dangerous class before any SSRF attack can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of the axis2-jaxws class enabling SSRF attacks. The upstream fix (commit 87d29af25e) added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.9.10.8 that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta. The target repository contains the complete fix at SubTypeValidator.java:78, which blocks deserialization of the dangerous class before any SSRF attack can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:47:30.687322+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for dangerous classes in polymorphic deserialization, specifically org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository is jackson-databind version 2.9.10.8-tuxcare.2, which already contains the upstream fix from FasterXML. The dangerous class is present in the blocklist at SubTypeValidator.java line 85, preventing polymorphic deserialization attacks. This fix was shipped in upstream version 2.9.8 (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta) and was already present when TuxCare onboarded version 2.9.10.8, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for dangerous classes in polymorphic deserialization, specifically org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository is jackson-databind version 2.9.10.8-tuxcare.2, which already contains the upstream fix from FasterXML. The dangerous class is present in the blocklist at SubTypeValidator.java line 85, preventing polymorphic deserialization attacks. This fix was shipped in upstream version 2.9.8 (commit 72cd4025a229fb28ec133235003dd4616f70afaa by Tatu Saloranta) and was already present when TuxCare onboarded version 2.9.10.8, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:55:41.476005+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) which can lead to arbitrary code execution. The target repository (jackson-databind 2.9.10.8-tuxcare.3) already contains the upstream fix in SubTypeValidator.java lines 82-83, where these openjpa classes are added to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 and was included in the upstream 2.9.10.8 release that TuxCare onboarded. Since the fix was already present in the upstream release (commit 72cd4025a2 is an ancestor of the first TuxCare commit ae0fed26c6 \"Onboard version 2.9.10.8\"), this is an upstream fix, not a TuxCare backport. Verdict: not_affected with justification code_not_present (the vulnerable pattern is not present due to the upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) which can lead to arbitrary code execution. The target repository (jackson-databind 2.9.10.8-tuxcare.3) already contains the upstream fix in SubTypeValidator.java lines 82-83, where these openjpa classes are added to the DEFAULT_NO_DESER_CLASS_NAMES blocklist. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 and was included in the upstream 2.9.10.8 release that TuxCare onboarded. Since the fix was already present in the upstream release (commit 72cd4025a2 is an ancestor of the first TuxCare commit ae0fed26c6 \"Onboard version 2.9.10.8\"), this is an upstream fix, not a TuxCare backport. Verdict: not_affected with justification code_not_present (the vulnerable pattern is not present due to the upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:24:24.833839+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.8-tuxcare.3) is not affected by CVE-2018-19362. The vulnerability pattern (missing blacklist entry for org.jboss.util.propertyeditor.DocumentEditor) is not present because the upstream vendor (FasterXML) already fixed it in commit 72cd4025a2 (Nov 19, 2018) before TuxCare onboarded version 2.9.10.8. The fix adds the jboss-common-core gadget class to the deserialization blacklist in SubTypeValidator.java, preventing polymorphic deserialization attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10.8-tuxcare.3) is not affected by CVE-2018-19362. The vulnerability pattern (missing blacklist entry for org.jboss.util.propertyeditor.DocumentEditor) is not present because the upstream vendor (FasterXML) already fixed it in commit 72cd4025a2 (Nov 19, 2018) before TuxCare onboarded version 2.9.10.8. The fix adds the jboss-common-core gadget class to the deserialization blacklist in SubTypeValidator.java, preventing polymorphic deserialization attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass previous blacklist protections to achieve remote code execution. The upstream vendor (FasterXML) added these classes to the SubTypeValidator blacklist in commit 038b471e2e on January 21, 2018. This fix was already included in the upstream release 2.9.10.8 that TuxCare onboarded on September 20, 2026. The vulnerable pattern (absence of these gadgets from the blacklist) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass previous blacklist protections to achieve remote code execution. The upstream vendor (FasterXML) added these classes to the SubTypeValidator blacklist in commit 038b471e2e on January 21, 2018. This fix was already included in the upstream release 2.9.10.8 that TuxCare onboarded on September 20, 2026. The vulnerable pattern (absence of these gadgets from the blacklist) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:46.709129+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target repository version 2.9.10.8-tuxcare.3 contains the upstream fix that was released in jackson-databind 2.9.5 (February 2018). The fix adds pattern-based blocking for c3p0 DataSource classes in SubTypeValidator.java (lines 24, 288-298). The fix commit 6799f8f10c was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.9.10.8 in September 2026. Therefore, the vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target repository version 2.9.10.8-tuxcare.3 contains the upstream fix that was released in jackson-databind 2.9.5 (February 2018). The fix adds pattern-based blocking for c3p0 DataSource classes in SubTypeValidator.java (lines 24, 288-298). The fix commit 6799f8f10c was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.9.10.8 in September 2026. Therefore, the vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:32:27.596761+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target is at version 2.9.10.8-tuxcare.3, which already contains the upstream fix. The vulnerability allowed arbitrary file reads through deserialization of com.mysql.cj.jdbc.admin.MiniAdmin when Default Typing was enabled. The fix (adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java) is present at line 88 and was shipped in the upstream release 2.9.10.8, not added as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target is at version 2.9.10.8-tuxcare.3, which already contains the upstream fix. The vulnerability allowed arbitrary file reads through deserialization of com.mysql.cj.jdbc.admin.MiniAdmin when Default Typing was enabled. The fix (adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java) is present at line 88 and was shipped in the upstream release 2.9.10.8, not added as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:33:00.155354+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization. The fix was already present in upstream version 2.9.10.8 (commit c9ef4a10d6 by Tatu Saloranta) before TuxCare onboarded this version. The blocklist entry exists at line 91 of SubTypeValid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization. The fix was already present in upstream version 2.9.10.8 (commit c9ef4a10d6 by Tatu Saloranta) before TuxCare onboarded this version. The blocklist entry exists at line 91 of SubTypeValid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:14:00.105022+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is not present in target version 2.9.10.8-tuxcare.3. The fix blocking JDOM XSLTransformer classes was already included in upstream release 2.9.10.8 before TuxCare onboarding. The blacklist entries for org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer are present in SubTypeValidator.java (lines 94-95), and the validation is unconditionally invoked during bea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is not present in target version 2.9.10.8-tuxcare.3. The fix blocking JDOM XSLTransformer classes was already included in upstream release 2.9.10.8 before TuxCare onboarding. The blacklist entries for org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer are present in SubTypeValidator.java (lines 94-95), and the validation is unconditionally invoked during bea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.9.10.8. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource classes when default typing is enabled. The target version already contains the upstream fix that adds these classes to the SubTypeValidator blacklist (lines 98, 102). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.10.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.9.10.8. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource classes when default typing is enabled. The target version already contains the upstream fix that adds these classes to the SubTypeValidator blacklist (lines 98, 102). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.9.10.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.9.10.8. The upstream fix (blocking ch.qos.logback.core.db.JNDIConnectionSource from deserialization) was included in version 2.9.9.2 and is present in the target version 2.9.10.8. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.9.10.8. The upstream fix (blocking ch.qos.logback.core.db.JNDIConnectionSource from deserialization) was included in version 2.9.9.2 and is present in the target version 2.9.10.8. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 concerns a polymorphic deserialization gadget vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target version 2.9.10.8 already contains the upstream vendor fix: both HikariConfig and HikariDataSource are present in the deserialization blocklist (SubTypeValidator.java lines 105, 107). These entries were added by upstream maintainer Tatu Saloranta in commits d4983c740 (Aug 2019) and 73c1c2cc7 (Sep 2019), which predated the 2.9.10.8 release (Jan 2021). The fix was already present when TuxCare onboarded this version. Verdict: not_affected because the vulnerable pattern (missing blocklist entries) is not present in the shipped version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 concerns a polymorphic deserialization gadget vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target version 2.9.10.8 already contains the upstream vendor fix: both HikariConfig and HikariDataSource are present in the deserialization blocklist (SubTypeValidator.java lines 105, 107). These entries were added by upstream maintainer Tatu Saloranta in commits d4983c740 (Aug 2019) and 73c1c2cc7 (Sep 2019), which predated the 2.9.10.8 release (Jan 2021). The fix was already present when TuxCare onboarded this version. Verdict: not_affected because the vulnerable pattern (missing blocklist entries) is not present in the shipped version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind, HEAD at the TuxCare 'onboard/2.9.10.8' merge (authoritative version 2.9.10.8, SHA 6cb03eb88). CVE-2019-14892 is a polymorphic-deserialization gadget CVE: with default/polymorphic typing enabled, an attacker supplies a JSON payload naming commons-configuration 1/2 JNDIConfiguration as the concrete type, triggering an attacker-controlled JNDI lookup and RCE. The upstream fix (databind#2462, commit 41b7f9b90) adds both class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES deny-list so validateSubType rejects them. The target's SubTypeValidator.java:112-114 contains those exact two entries verbatim. git blame shows the lines were authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in the original 2019 upstream fix commit 41b7f9b90 \u2014 an ancestor of HEAD reached through the normal upstream 2.7->2.8->2.9 merge chain. No TuxCare/CloudLinux backport MR for this CVE exists; the fix was already present in the stock upstream 2.9.10.x line (fixed in 2.9.10) and merely imported by the onboard merge. Enforcement is wired: BeanDeserializerFactory:135 -> _validateSubType:919 -> SubTypeValidator.validateSubType -> deny-list contains(full) -> reportBadTypeDefinition throws. This is the upstream-fix-already-in-shipped-version case: not_affected / code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "not_affected \u2014 Target is jackson-databind, HEAD at the TuxCare 'onboard/2.9.10.8' merge (authoritative version 2.9.10.8, SHA 6cb03eb88). CVE-2019-14892 is a polymorphic-deserialization gadget CVE: with default/polymorphic typing enabled, an attacker supplies a JSON payload naming commons-configuration 1/2 JNDIConfiguration as the concrete type, triggering an attacker-controlled JNDI lookup and RCE. The upstream fix (databind#2462, commit 41b7f9b90) adds both class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES deny-list so validateSubType rejects them. The target's SubTypeValidator.java:112-114 contains those exact two entries verbatim. git blame shows the lines were authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in the original 2019 upstream fix commit 41b7f9b90 \u2014 an ancestor of HEAD reached through the normal upstream 2.7->2.8->2.9 merge chain. No TuxCare/CloudLinux backport MR for this CVE exists; the fix was already present in the stock upstream 2.9.10.x line (fixed in 2.9.10) and merely imported by the onboard merge. Enforcement is wired: BeanDeserializerFactory:135 -> _validateSubType:919 -> SubTypeValidator.validateSubType -> deny-list contains(full) -> reportBadTypeDefinition throws. This is the upstream-fix-already-in-shipped-version case: not_affected / code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.9.10.8 (TuxCare ELS onboarding of the upstream micro-patch release). CVE-2019-14893 is the xalan JNDI gadget deserialization RCE, fixed by the vendor by adding class name \"org.apache.xalan.lib.sql.JNDIConnectionPool\" (databind#2469) to the SubTypeValidator deny-list. The target ALREADY CONTAINS this exact fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:117, plus the internal xalan2 variant \"com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool\" (#2704) at line 119. git blame shows line 117 was introduced by commit 998efd708284778f29d83d7962a9bd935c228317 \u2014 the exact vendor patch SHA given as input \u2014 authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. The SHA is byte-identical to the upstream commit (a backport would carry a new SHA), the fix is an ancestor of the onboard merge's upstream first-parent, and it ships in the upstream jackson-databind-2.9.10 tag. This is an UPSTREAM/vendor fix present in the shipped baseline, not a TuxCare backport \u2014 verdict not_affected (justification code_not_present). The vulnerable pre-fix pattern (missing deny-list entry) does not exist in HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "not_affected \u2014 Target is jackson-databind 2.9.10.8 (TuxCare ELS onboarding of the upstream micro-patch release). CVE-2019-14893 is the xalan JNDI gadget deserialization RCE, fixed by the vendor by adding class name \"org.apache.xalan.lib.sql.JNDIConnectionPool\" (databind#2469) to the SubTypeValidator deny-list. The target ALREADY CONTAINS this exact fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:117, plus the internal xalan2 variant \"com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool\" (#2704) at line 119. git blame shows line 117 was introduced by commit 998efd708284778f29d83d7962a9bd935c228317 \u2014 the exact vendor patch SHA given as input \u2014 authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. The SHA is byte-identical to the upstream commit (a backport would carry a new SHA), the fix is an ancestor of the onboard merge's upstream first-parent, and it ships in the upstream jackson-databind-2.9.10 tag. This is an UPSTREAM/vendor fix present in the shipped baseline, not a TuxCare backport \u2014 verdict not_affected (justification code_not_present). The vulnerable pre-fix pattern (missing deny-list entry) does not exist in HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is FasterXML jackson-databind (pom version 2.9.10.20210106 / authoritative 2.9.10.8), an ELS-maintained tree. CVE-2019-16335 is a polymorphic-typing deserialization gadget CVE for com.zaxxer.hikari.HikariDataSource, fixed upstream (issue #2449) by adding that class to jackson-databind's deserialization deny-list in SubTypeValidator. The fix is ALREADY PRESENT in HEAD: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:107 contains s.add(\"com.zaxxer.hikari.HikariDataSource\"); with the exact upstream comment \"[databind#2449]: and sub-class thereof\" at line 106. This entry is wired into validateSubType() which, before any subtype is instantiated, matches the incoming class name against _cfgIllegalClassNames (= DEFAULT_NO_DESER_CLASS_NAMES) and, on a hit, throws \"Illegal type (...) to deserialize: prevented for security reasons\" (lines 269, 302-303). git blame attributes line 107 to the exact upstream fix commit 73c1c2cc (Tatu Saloranta, tatu.saloranta@iki.fi, 2019-09-12) \u2014 NOT a TuxCare backport; no CloudLinux/TuxCare author ever touched this file. The shipped version (2.9.10.x) is at/after 2.9.10 where the fix first landed, so the vulnerable pattern (missing deny-list entry) is not present. Verdict: not_affected (upstream vendor fix baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "not_affected \u2014 Target is FasterXML jackson-databind (pom version 2.9.10.20210106 / authoritative 2.9.10.8), an ELS-maintained tree. CVE-2019-16335 is a polymorphic-typing deserialization gadget CVE for com.zaxxer.hikari.HikariDataSource, fixed upstream (issue #2449) by adding that class to jackson-databind's deserialization deny-list in SubTypeValidator. The fix is ALREADY PRESENT in HEAD: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:107 contains s.add(\"com.zaxxer.hikari.HikariDataSource\"); with the exact upstream comment \"[databind#2449]: and sub-class thereof\" at line 106. This entry is wired into validateSubType() which, before any subtype is instantiated, matches the incoming class name against _cfgIllegalClassNames (= DEFAULT_NO_DESER_CLASS_NAMES) and, on a hit, throws \"Illegal type (...) to deserialize: prevented for security reasons\" (lines 269, 302-303). git blame attributes line 107 to the exact upstream fix commit 73c1c2cc (Tatu Saloranta, tatu.saloranta@iki.fi, 2019-09-12) \u2014 NOT a TuxCare backport; no CloudLinux/TuxCare author ever touched this file. The shipped version (2.9.10.x) is at/after 2.9.10 where the fix first landed, so the vulnerable pattern (missing deny-list entry) is not present. Verdict: not_affected (upstream vendor fix baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:04:18.596746+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.8 is NOT vulnerable to CVE-2019-16942. The vulnerability pattern has been removed by an upstream fix that was already present in the version 2.9.10.8 release. The fix adds org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java (lines 124-125), preventing the polymorphic typing deserialization gadget chain exploitation described in the CVE. This fix was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9593e16cf5, which was already included in the upstream 2.9.10.8 release when TuxCare onboarded it via commit ae0fed26c6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "The target jackson-databind version 2.9.10.8 is NOT vulnerable to CVE-2019-16942. The vulnerability pattern has been removed by an upstream fix that was already present in the version 2.9.10.8 release. The fix adds org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java (lines 124-125), preventing the polymorphic typing deserialization gadget chain exploitation described in the CVE. This fix was authored by the upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9593e16cf5, which was already included in the upstream 2.9.10.8 release when TuxCare onboarded it via commit ae0fed26c6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:14:22.639496+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 due to unsafe polymorphic deserialization of com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes when Default Typing is enabled. The target version 2.9.10.8 already includes the upstream fix (commits 9593e16cf5 and 328a0f833d by tatu.saloranta@iki.fi) that adds these classes to the deserialization blocklist. The fix was introduced in version 2.9.10.1 and is present in all subsequent 2.9.10.x releases including 2.9.10.8. The vulnerable code pattern (unrestricted deserialization of P6DataSource) is not present because the upstream release already contained the blocklist defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 affects jackson-databind versions prior to 2.9.10.1 due to unsafe polymorphic deserialization of com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes when Default Typing is enabled. The target version 2.9.10.8 already includes the upstream fix (commits 9593e16cf5 and 328a0f833d by tatu.saloranta@iki.fi) that adds these classes to the deserialization blocklist. The fix was introduced in version 2.9.10.1 and is present in all subsequent 2.9.10.x releases including 2.9.10.8. The vulnerable code pattern (unrestricted deserialization of P6DataSource) is not present because the upstream release already contained the blocklist defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default-typing) gadget vulnerability: with default typing enabled, an attacker-controlled JSON type identifier naming net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup can be deserialized, triggering a JNDI/JTA lookup that leads to RCE/SSRF. The vendor fix (commit 191a4cdf87) adds this class name to jackson-databind's deserialization deny-list in SubTypeValidator.java.\n\nThe target (jackson-databind 2.9.10.8, SHA 6cb03eb8) ALREADY CONTAINS the fix: SubTypeValidator.java line 99 has `s.add(\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\");`, under the `[databind#2387], [databind#2460]: EHCache` comment (lines 97-99). git blame attributes line 99 to the exact upstream patch commit 191a4cdf87, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. This fix shipped in upstream 2.9.10 (CVE is \"before 2.9.10\"; target 2.9.10.8 is later in the same line) and is an ancestor of the onboarded upstream baseline. The deny-list is enforced via BeanDeserializerFactory._validateSubType -> SubTypeValidator.validateSubType, which rejects the class with \"Illegal type ... prevented for security reasons\".\n\nVerdict: not_affected \u2014 upstream/vendor-authored fix already present in the shipped version (the vulnerable missing-deny-list-entry pattern is not present in HEAD). Not already_fixed: the fix is upstream-authored, not a CloudLinux/TuxCare backport. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default-typing) gadget vulnerability: with default typing enabled, an attacker-controlled JSON type identifier naming net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup can be deserialized, triggering a JNDI/JTA lookup that leads to RCE/SSRF. The vendor fix (commit 191a4cdf87) adds this class name to jackson-databind's deserialization deny-list in SubTypeValidator.java.\n\nThe target (jackson-databind 2.9.10.8, SHA 6cb03eb8) ALREADY CONTAINS the fix: SubTypeValidator.java line 99 has `s.add(\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\");`, under the `[databind#2387], [databind#2460]: EHCache` comment (lines 97-99). git blame attributes line 99 to the exact upstream patch commit 191a4cdf87, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. This fix shipped in upstream 2.9.10 (CVE is \"before 2.9.10\"; target 2.9.10.8 is later in the same line) and is an ancestor of the onboarded upstream baseline. The deny-list is enforced via BeanDeserializerFactory._validateSubType -> SubTypeValidator.validateSubType, which rejects the class with \"Illegal type ... prevented for security reasons\".\n\nVerdict: not_affected \u2014 upstream/vendor-authored fix already present in the shipped version (the vulnerable missing-deny-list-entry pattern is not present in HEAD). Not already_fixed: the fix is upstream-authored, not a CloudLinux/TuxCare backport. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:47:28.358565+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) was already included in version 2.9.10.8 when TuxCare onboarded it. The fix adds org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java, preventing arbitrary code execution via JNDI injection. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) was already included in version 2.9.10.8 when TuxCare onboarded it. The fix adds org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java, preventing arbitrary code execution via JNDI injection. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT vulnerable to CVE-2019-20330. The vulnerability (lack of blocking for net.sf.ehcache classes GenericJndiSelector and GlassfishSelector in polymorphic deserialization) was fixed in the upstream release 2.9.10.8, which TuxCare later onboarded. The fix commit fc4214a883d by upstream maintainer Tatu Saloranta added both ehcache classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 133-135), preventing their deserialization. This fix was already present when TuxCare onboarded version 2.9.10.8 via commit ae0fed26c67, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT vulnerable to CVE-2019-20330. The vulnerability (lack of blocking for net.sf.ehcache classes GenericJndiSelector and GlassfishSelector in polymorphic deserialization) was fixed in the upstream release 2.9.10.8, which TuxCare later onboarded. The fix commit fc4214a883d by upstream maintainer Tatu Saloranta added both ehcache classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 133-135), preventing their deserialization. This fix was already present when TuxCare onboarded version 2.9.10.8 via commit ae0fed26c67, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:58.863426+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.10.8 is NOT vulnerable to CVE-2020-10650. The upstream vendor (FasterXML) fixed this vulnerability by adding three JNDI gadget classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.8 when TuxCare onboarded it. The blocklist is properly integrated into the deserialization path via BeanDeserializerFactory and prevents instantiation of these dangerous classes, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "Target jackson-databind 2.9.10.8 is NOT vulnerable to CVE-2020-10650. The upstream vendor (FasterXML) fixed this vulnerability by adding three JNDI gadget classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.9.10.8 when TuxCare onboarded it. The blocklist is properly integrated into the deserialization path via BeanDeserializerFactory and prevents instantiation of these dangerous classes, blocking the attack chain from JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.8-tuxcare.3) is not affected by CVE-2020-10672. The vulnerability involves unsafe deserialization of org.apache.aries.transaction.jms gadget classes. The upstream fix (commit 592872f423) added blacklist entries for these classes to SubTypeValidator.java, preventing their deserialization. This fix was already present in upstream version 2.9.10.8 that TuxCare onboarded, as confirmed by git history showing the fix commit is an ancestor of the first TuxCare commit (ae0fed26c6 \"Onboard version 2.9.10.8\"). The defense is active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10.8-tuxcare.3) is not affected by CVE-2020-10672. The vulnerability involves unsafe deserialization of org.apache.aries.transaction.jms gadget classes. The upstream fix (commit 592872f423) added blacklist entries for these classes to SubTypeValidator.java, preventing their deserialization. This fix was already present in upstream version 2.9.10.8 that TuxCare onboarded, as confirmed by git history showing the fix commit is an ancestor of the first TuxCare commit (ae0fed26c6 \"Onboard version 2.9.10.8\"). The defense is active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT affected by CVE-2020-10673. The vulnerability involves deserialization gadgets using com.caucho.config.types.ResourceRef, which could enable arbitrary code execution through polymorphic type handling. The fix (commit 1645efbd39) adds ResourceRef to the SubTypeValidator blocklist at line 167, preventing its deserialization. This fix was part of the upstream release 2.9.10.8, which predates TuxCare's onboarding commit ae0fed26c6. The fix is authored by Tatu Saloranta (tatu.saloranta@iki.fi), an upstream maintainer, not a TuxCare engineer. Per the fixing-commit attribution rules, this is an upstream fix that shipped in the release, resulting in a not_affected verdict with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT affected by CVE-2020-10673. The vulnerability involves deserialization gadgets using com.caucho.config.types.ResourceRef, which could enable arbitrary code execution through polymorphic type handling. The fix (commit 1645efbd39) adds ResourceRef to the SubTypeValidator blocklist at line 167, preventing its deserialization. This fix was part of the upstream release 2.9.10.8, which predates TuxCare's onboarding commit ae0fed26c6. The fix is authored by Tatu Saloranta (tatu.saloranta@iki.fi), an upstream maintainer, not a TuxCare engineer. Per the fixing-commit attribution rules, this is an upstream fix that shipped in the release, resulting in a not_affected verdict with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget classes. The target version 2.9.10.8-tuxcare.3 is NOT affected because the upstream fix (commit 05d7e0e13f by Tatu Saloranta) was already present in the upstream release 2.9.10.4+ that TuxCare onboarded. The vulnerable code pattern is not present - SubTypeValidator.java contains blocklist entries for both RmiProvider classes at lines 170-171, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.aoju.bus.proxy.provider.remoting.RmiProvider gadget classes. The target version 2.9.10.8-tuxcare.3 is NOT affected because the upstream fix (commit 05d7e0e13f by Tatu Saloranta) was already present in the upstream release 2.9.10.4+ that TuxCare onboarded. The vulnerable code pattern is not present - SubTypeValidator.java contains blocklist entries for both RmiProvider classes at lines 170-171, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10.8-tuxcare.3) is NOT vulnerable to CVE-2020-10969. The vulnerability concerns deserialization of javax.swing.JEditorPane through Jackson's polymorphic typing feature, which could lead to arbitrary code execution. The fix (adding javax.swing.JEditorPane to the deserialization blocklist in SubTypeValidator.java) was included in upstream release 2.9.10.8, which TuxCare onboarded without modification. The vulnerable code pattern is not present because the upstream vendor (FasterXML) fixed it before version 2.9.10.8 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10.8-tuxcare.3) is NOT vulnerable to CVE-2020-10969. The vulnerability concerns deserialization of javax.swing.JEditorPane through Jackson's polymorphic typing feature, which could lead to arbitrary code execution. The fix (adding javax.swing.JEditorPane to the deserialization blocklist in SubTypeValidator.java) was included in upstream release 2.9.10.8, which TuxCare onboarded without modification. The vulnerable code pattern is not present because the upstream vendor (FasterXML) fixed it before version 2.9.10.8 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.8 is NOT affected by CVE-2020-11111. The upstream fix from jackson-databind 2.9.10.4 (commit c14c9f99ed) is already present in the target. The fix adds 9 org.apache.activemq.* classes to the deserialization blocklist in SubTypeValidator.java (lines 173-183), preventing the gadget chain exploitation described in the CVE. This fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.4, which TuxCare later onboarded as version 2.9.10.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "Target version 2.9.10.8 is NOT affected by CVE-2020-11111. The upstream fix from jackson-databind 2.9.10.4 (commit c14c9f99ed) is already present in the target. The fix adds 9 org.apache.activemq.* classes to the deserialization blocklist in SubTypeValidator.java (lines 173-183), preventing the gadget chain exploitation described in the CVE. This fix was authored by upstream maintainer Tatu Saloranta and shipped in release 2.9.10.4, which TuxCare later onboarded as version 2.9.10.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10.8-tuxcare.3 is NOT AFFECTED by CVE-2020-11112. The vulnerability involved the ability to deserialize the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider, which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f by adding this class to the deserialization blocklist in SubTypeValidator.java (line 186). This fix was already present in the upstream release 2.9.10.8 when TuxCare onboarded it (commit ae0fed26c6). The vulnerable code pattern is not present in the target because the blocklist entry prevents deserialization of the RmiProvider class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "The target jackson-databind version 2.9.10.8-tuxcare.3 is NOT AFFECTED by CVE-2020-11112. The vulnerability involved the ability to deserialize the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider, which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f by adding this class to the deserialization blocklist in SubTypeValidator.java (line 186). This fix was already present in the upstream release 2.9.10.8 when TuxCare onboarded it (commit ae0fed26c6). The vulnerable code pattern is not present in the target because the blocklist entry prevents deserialization of the RmiProvider class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream vendor fix (commit e2ba12d5d6 by Tatu Saloranta) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was already included in the upstream jackson-databind 2.9.10.8 release that TuxCare onboarded, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability concerns polymorphic deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream vendor fix (commit e2ba12d5d6 by Tatu Saloranta) added this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was already included in the upstream jackson-databind 2.9.10.8 release that TuxCare onboarded, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is not present in this target. The vulnerability involves deserialization gadgets using Spring AOP classes (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean). The fix was already present in the upstream jackson-databind 2.9.10.8 release that TuxCare onboarded. The target's SubTypeValidator.java contains the blocklist entries (lines 53-54) that prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is not present in this target. The vulnerability involves deserialization gadgets using Spring AOP classes (org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean). The fix was already present in the upstream jackson-databind 2.9.10.8 release that TuxCare onboarded. The target's SubTypeValidator.java contains the blocklist entries (lines 53-54) that prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The target already contains the upstream fix: this class is blocked in SubTypeValidator.java at line 189. The fix was introduced in upstream commit 77040d85e3eb6710508e6445640ae1a3d5e60c22 by Tatu Saloranta, which shipped in the upstream 2.9.10.8 release that TuxCare onboarded. Since the fix was already in the upstream release (before any TuxCare backports), the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the gadget class org.apache.commons.jelly.impl.Embedded. The target already contains the upstream fix: this class is blocked in SubTypeValidator.java at line 189. The fix was introduced in upstream commit 77040d85e3eb6710508e6445640ae1a3d5e60c22 by Tatu Saloranta, which shipped in the upstream 2.9.10.8 release that TuxCare onboarded. Since the fix was already in the upstream release (before any TuxCare backports), the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization gadgets (specifically oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) that enable JNDI injection attacks. The fix\u2014adding these gadget classes to SubTypeValidator's blocklist\u2014was already present in upstream release 2.9.10.8, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), and included when TuxCare onboarded this version. The dangerous gadget classes are blocked at lines 192-195 of SubTypeValidator.java, preventing their deserialization when polymorphic type handling is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization gadgets (specifically oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) that enable JNDI injection attacks. The fix\u2014adding these gadget classes to SubTypeValidator's blocklist\u2014was already present in upstream release 2.9.10.8, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi), and included when TuxCare onboarded this version. The dangerous gadget classes are blocked at lines 192-195 of SubTypeValidator.java, preventing their deserialization when polymorphic type handling is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 (Oracle JMS deserialization gadget) is NOT present in jackson-databind 2.9.10.8. The vulnerability affects versions before 2.9.10.5, and the target version 2.9.10.8 already contains the upstream fix. The five Oracle JMS classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are blacklisted in SubTypeValidator.java lines 200-204. This fix was authored by upstream maintainer Tatu Saloranta (commit 5c8642aeae9) and was already present in the upstream release 2.9.10.8 when TuxCare onboarded it (first TuxCare commit: ae0fed26c67 \"Onboard version 2.9.10.8\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 (Oracle JMS deserialization gadget) is NOT present in jackson-databind 2.9.10.8. The vulnerability affects versions before 2.9.10.5, and the target version 2.9.10.8 already contains the upstream fix. The five Oracle JMS classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) are blacklisted in SubTypeValidator.java lines 200-204. This fix was authored by upstream maintainer Tatu Saloranta (commit 5c8642aeae9) and was already present in the upstream release 2.9.10.8 when TuxCare onboarded it (first TuxCare commit: ae0fed26c67 \"Onboard version 2.9.10.8\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.9.10.8 already contains the upstream fix (commit 840eae2ca81) which adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator.java. This fix was shipped in the upstream release 2.9.10.5 and was present when TuxCare onboarded version 2.9.10.8. The vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.9.10.8 already contains the upstream fix (commit 840eae2ca81) which adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator.java. This fix was shipped in the upstream release 2.9.10.5 and was present when TuxCare onboarded version 2.9.10.8. The vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 targets jackson-databind versions before 2.9.10.5, involving deserialization of org.jsecurity.realm.jndi.JndiRealmFactory. The target repository is jackson-databind 2.9.10.8-tuxcare.3, which contains the upstream fix that blocks this class from deserialization. The fix (commit f6d9c664) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.10.8 release that TuxCare onboarded (commit ae0fed26c6). The vulnerable pattern was never present in what TuxCare shipped.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 targets jackson-databind versions before 2.9.10.5, involving deserialization of org.jsecurity.realm.jndi.JndiRealmFactory. The target repository is jackson-databind 2.9.10.8-tuxcare.3, which contains the upstream fix that blocks this class from deserialization. The fix (commit f6d9c664) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.9.10.8 release that TuxCare onboarded (commit ae0fed26c6). The vulnerable pattern was never present in what TuxCare shipped.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:19:24.952513+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability concerns unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream fix (commit 3d97153944f by Tatu Saloranta, 2020-08-10) added this class to the SubTypeValidator blocklist at line 147, preventing its deserialization. This fix was already included in upstream release 2.9.10.8 before TuxCare onboarded the code (onboarding commit ae0fed26c by amoniatovskiy@cloudlinux.com). The target is not vulnerable because the defensive code shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability concerns unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The upstream fix (commit 3d97153944f by Tatu Saloranta, 2020-08-10) added this class to the SubTypeValidator blocklist at line 147, preventing its deserialization. This fix was already included in upstream release 2.9.10.8 before TuxCare onboarded the code (onboarding commit ae0fed26c by amoniatovskiy@cloudlinux.com). The target is not vulnerable because the defensive code shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:14:37.389349+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration, which can lead to arbitrary code execution via JNDI injection. The fix (blocking this class in SubTypeValidator) was already present in upstream version 2.9.10.8 before TuxCare onboarded it. The fix commit (6cc9f1a1af) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the TuxCare onboarding commit (ae0fed26c6), confirming it shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration, which can lead to arbitrary code execution via JNDI injection. The fix (blocking this class in SubTypeValidator) was already present in upstream version 2.9.10.8 before TuxCare onboarded it. The fix commit (6cc9f1a1af) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the TuxCare onboarding commit (ae0fed26c6), confirming it shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) was fixed by upstream FasterXML in version 2.9.10.7 (released 02-Dec-2020). The target repository is at version 2.9.10.8 (released 06-Jan-2021), which contains the complete upstream fix. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) was fixed by upstream FasterXML in version 2.9.10.7 (released 02-Dec-2020). The target repository is at version 2.9.10.8 (released 06-Jan-2021), which contains the complete upstream fix. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:20:46.497840+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.8 is not affected by CVE-2020-35490. The fix blocking deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes was already present in the upstream 2.9.10.8 release that TuxCare onboarded. The vulnerable pattern (ability to deserialize these gadget classes) has been removed by the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target jackson-databind 2.9.10.8 is not affected by CVE-2020-35490. The fix blocking deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes was already present in the upstream 2.9.10.8 release that TuxCare onboarded. The vulnerable pattern (ability to deserialize these gadget classes) has been removed by the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:33:19.742472+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.8-tuxcare.2 is NOT AFFECTED by CVE-2020-35491. The vulnerability (deserialization of Apache Commons DBCP2 gadget classes SharedPoolDataSource and PerUserPoolDataSource) was fixed in upstream version 2.9.10.8 before TuxCare onboarded it. The fix, authored by Tatu Saloranta (upstream maintainer), adds these class names to SubTypeValidator's deserialization blocklist, preventing exploitation of the polymorphic deserialization gadget. The defense is actively enforced at lines 216-219 and validated at line 269 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "The target jackson-databind 2.9.10.8-tuxcare.2 is NOT AFFECTED by CVE-2020-35491. The vulnerability (deserialization of Apache Commons DBCP2 gadget classes SharedPoolDataSource and PerUserPoolDataSource) was fixed in upstream version 2.9.10.8 before TuxCare onboarded it. The fix, authored by Tatu Saloranta (upstream maintainer), adds these class names to SubTypeValidator's deserialization blocklist, preventing exploitation of the polymorphic deserialization gadget. The defense is actively enforced at lines 216-219 and validated at line 269 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:00.210651+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool leading to JNDI injection and code execution. The fix (blacklisting this class in SubTypeValidator.java) was already included in the upstream FasterXML 2.9.10.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the upstream vendor fixed it prior to the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool leading to JNDI injection and code execution. The fix (blacklisting this class in SubTypeValidator.java) was already included in the upstream FasterXML 2.9.10.8 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the upstream vendor fixed it prior to the TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:14.873847+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.8 is NOT vulnerable to CVE-2020-36179. The vulnerability relates to unsafe polymorphic deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related variants. The upstream vendor (FasterXML/Tatu Saloranta) fixed this in commit 3ded28aece on 2020-12-31 by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was included in the upstream 2.9.10.8 release, which is the version TuxCare onboarded. The CVE states versions \"before 2.9.10.8\" are affected, and the target is exactly version 2.9.10.8 with the fix already present. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "The target repository jackson-databind version 2.9.10.8 is NOT vulnerable to CVE-2020-36179. The vulnerability relates to unsafe polymorphic deserialization of the gadget class `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS` and related variants. The upstream vendor (FasterXML/Tatu Saloranta) fixed this in commit 3ded28aece on 2020-12-31 by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was included in the upstream 2.9.10.8 release, which is the version TuxCare onboarded. The CVE states versions \"before 2.9.10.8\" are affected, and the target is exactly version 2.9.10.8 with the fix already present. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is not present in jackson-databind 2.9.10.8. The vulnerability involves polymorphic deserialization gadget attacks using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes. The fix (commit 3ded28aece) adds these dangerous class names to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream release 2.9.10.8 before TuxCare onboarding, as confirmed by the commit being an ancestor of the first TuxCare commit (ae0fed26c6 \"Onboard version 2.9.10.8\"). The target code at lines 219, 193, 228, and 234 of SubTypeValidator.java contains all required blocklist entries including org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and its variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is not present in jackson-databind 2.9.10.8. The vulnerability involves polymorphic deserialization gadget attacks using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes. The fix (commit 3ded28aece) adds these dangerous class names to SubTypeValidator's blocklist, preventing their deserialization. This fix was already present in upstream release 2.9.10.8 before TuxCare onboarding, as confirmed by the commit being an ancestor of the first TuxCare commit (ae0fed26c6 \"Onboard version 2.9.10.8\"). The target code at lines 219, 193, 228, and 234 of SubTypeValidator.java contains all required blocklist entries including org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and its variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:40:52.879992+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8. The target repository is version 2.9.10.8-tuxcare.3, which already includes the upstream fix. The dangerous class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS is blocked in SubTypeValidator.java at line 228, preventing deserialization gadget attacks. The fix was authored by Tatu Saloranta and shipped in the upstream 2.9.10.8 release that TuxCare onboarded, making this a vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8. The target repository is version 2.9.10.8-tuxcare.3, which already includes the upstream fix. The dangerous class org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS is blocked in SubTypeValidator.java at line 228, preventing deserialization gadget attacks. The fix was authored by Tatu Saloranta and shipped in the upstream 2.9.10.8 release that TuxCare onboarded, making this a vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:02.519749+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.9.10.8-tuxcare.3. The upstream fix (commit 3ded28aece by Tatu Saloranta) added DriverAdapterCPDS class variants to the deserialization blacklist before version 2.9.10.8 was released. This fix was already present when TuxCare onboarded the version. The vulnerable pattern (ability to deserialize org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes) cannot manifest because SubTypeValidator rejects these classes during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.9.10.8-tuxcare.3. The upstream fix (commit 3ded28aece by Tatu Saloranta) added DriverAdapterCPDS class variants to the deserialization blacklist before version 2.9.10.8 was released. This fix was already present when TuxCare onboarded the version. The vulnerable pattern (ability to deserialize org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes) cannot manifest because SubTypeValidator rejects these classes during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:29.978023+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 concerns a Jackson databind deserialization gadget (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that enables JNDI injection attacks. The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) fix was already present in the 2.9.10.8 release that TuxCare onboarded. The dangerous gadget class is blacklisted in SubTypeValidator.java at line 243, preventing its deserialization. Fix commit 12e23c962ff authored by Tatu Saloranta (upstream maintainer) on 2020-12-31 was already part of the upstream release before TuxCare's first commit (ae0fed26c67 \"Onboard version 2.9.10.8\"). The vulnerable code path does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 concerns a Jackson databind deserialization gadget (org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool) that enables JNDI injection attacks. The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT AFFECTED because the upstream vendor (FasterXML) fix was already present in the 2.9.10.8 release that TuxCare onboarded. The dangerous gadget class is blacklisted in SubTypeValidator.java at line 243, preventing its deserialization. Fix commit 12e23c962ff authored by Tatu Saloranta (upstream maintainer) on 2020-12-31 was already part of the upstream release before TuxCare's first commit (ae0fed26c67 \"Onboard version 2.9.10.8\"). The vulnerable code path does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.9.10.8. The fix (commit 567194c53a) that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was authored by upstream maintainer Tatu Saloranta and shipped as part of the upstream 2.9.10.8 release. The vulnerable classes are present in the deserialization blocklist at SubTypeValidator.java:235-236, preventing the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.9.10.8. The fix (commit 567194c53a) that blocks deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was authored by upstream maintainer Tatu Saloranta and shipped as part of the upstream 2.9.10.8 release. The vulnerable classes are present in the deserialization blocklist at SubTypeValidator.java:235-236, preventing the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for org.apache.tomcat.dbcp.dbcp2.datasources gadget classes. The target repository is version 2.9.10.8-tuxcare.3, which already contains the upstream fix (commit 567194c53a \"Fixed #2998\") that was shipped in the original 2.9.10.8 release. The fix adds SharedPoolDataSource and PerUserPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing deserialization of these gadget classes. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blacklist entries for org.apache.tomcat.dbcp.dbcp2.datasources gadget classes. The target repository is version 2.9.10.8-tuxcare.3, which already contains the upstream fix (commit 567194c53a \"Fixed #2998\") that was shipped in the original 2.9.10.8 release. The fix adds SharedPoolDataSource and PerUserPoolDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing deserialization of these gadget classes. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:29:58.600651+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10.8-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability allows remote code execution through deserialization of dangerous classes `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource` and `SharedPoolDataSource`. The upstream vendor's fix (commit 3e8fa3beea4 by Tatu Saloranta) added these class names to the blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already present in the upstream release 2.9.10.8 when TuxCare onboarded it, confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (ae0fed26c67). The vulnerable pattern is not present in the target because the upstream fix shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target jackson-databind 2.9.10.8-tuxcare.3 is not affected by CVE-2020-36186. The vulnerability allows remote code execution through deserialization of dangerous classes `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource` and `SharedPoolDataSource`. The upstream vendor's fix (commit 3e8fa3beea4 by Tatu Saloranta) added these class names to the blocklist in SubTypeValidator.java, preventing their deserialization. This fix was already present in the upstream release 2.9.10.8 when TuxCare onboarded it, confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (ae0fed26c67). The vulnerable pattern is not present in the target because the upstream fix shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:43:31.851746+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to missing deserialization protection for org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The target repository (version 2.9.10.8-tuxcare.3) contains the upstream fix at SubTypeValidator.java lines 226-230, which blocks this gadget class from deserialization. The fix was already present in the upstream 2.9.10.8 release when TuxCare onboarded it via commit ae0fed26c6720771ae3e2cc0008ed1353c3a3dca.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to missing deserialization protection for org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The target repository (version 2.9.10.8-tuxcare.3) contains the upstream fix at SubTypeValidator.java lines 226-230, which blocks this gadget class from deserialization. The fix was already present in the upstream 2.9.10.8 release when TuxCare onboarded it via commit ae0fed26c6720771ae3e2cc0008ed1353c3a3dca.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:50:08.266665+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT vulnerable to CVE-2020-36188. The upstream fix that blocks deserialization of the two newrelic gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) was already included in the upstream release 2.9.10.8, which TuxCare subsequently onboarded. The fix commit (33d96c13fe) was authored by Tatu Saloranta (upstream maintainer) and is an ancestor of the first TuxCare commit, confirming it was part of the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "The target repository jackson-databind version 2.9.10.8-tuxcare.3 is NOT vulnerable to CVE-2020-36188. The upstream fix that blocks deserialization of the two newrelic gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) was already included in the upstream release 2.9.10.8, which TuxCare subsequently onboarded. The fix commit (33d96c13fe) was authored by Tatu Saloranta (upstream maintainer) and is an ancestor of the first TuxCare commit, confirming it was part of the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository version 2.9.10.8 is NOT AFFECTED by CVE-2020-36189. The fix for this deserialization gadget vulnerability (blacklisting com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) is present in SubTypeValidator.java at lines 223-224. This fix was introduced by upstream commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 authored by Tatu Saloranta (tatu.saloranta@iki.fi), which is an ancestor of the first TuxCare commit (ae0fed26c6720771ae3e2cc0008ed1353c3a3dca \"Onboard version 2.9.10.8\"). Therefore, the fix shipped with the upstream 2.9.10.8 release before TuxCare onboarded this version, meaning the vulnerable code pattern was never present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "The target repository version 2.9.10.8 is NOT AFFECTED by CVE-2020-36189. The fix for this deserialization gadget vulnerability (blacklisting com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) is present in SubTypeValidator.java at lines 223-224. This fix was introduced by upstream commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 authored by Tatu Saloranta (tatu.saloranta@iki.fi), which is an ancestor of the first TuxCare commit (ae0fed26c6720771ae3e2cc0008ed1353c3a3dca \"Onboard version 2.9.10.8\"). Therefore, the fix shipped with the upstream 2.9.10.8 release before TuxCare onboarded this version, meaning the vulnerable code pattern was never present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:10:12.627525+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target repository (version 2.9.10.8-tuxcare.3) is NOT affected because the upstream fix was already shipped in version 2.9.10.8, which TuxCare later onboarded. The vulnerable code pattern is not present: JndiConverter is properly blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java at line 138.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking xbean-reflect/JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target repository (version 2.9.10.8-tuxcare.3) is NOT affected because the upstream fix was already shipped in version 2.9.10.8, which TuxCare later onboarded. The vulnerable code pattern is not present: JndiConverter is properly blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java at line 138.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.4 that was onboarded by TuxCare. The fix commit (9f4e97019fb) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (ae0fed26c6 'Onboard version 2.9.10.8'), confirming this is an upstream fix that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java) was already present in the upstream release 2.9.10.4 that was onboarded by TuxCare. The fix commit (9f4e97019fb) was authored by upstream maintainer Tatu Saloranta and is an ancestor of the first TuxCare commit (ae0fed26c6 'Onboard version 2.9.10.8'), confirming this is an upstream fix that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:17.536969+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability was fixed in upstream release 2.9.10.4 by adding \"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig\" to the SubTypeValidator blocklist. The target version (2.9.10.8) already contains this upstream fix, which was present when TuxCare onboarded the version. The blocklist entry at SubTypeValidator.java:144 prevents deserialization of the malicious gadget class, blocking the attack chain before arbitrary code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.9.10.8-tuxcare.3. The vulnerability was fixed in upstream release 2.9.10.4 by adding \"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig\" to the SubTypeValidator blocklist. The target version (2.9.10.8) already contains this upstream fix, which was present when TuxCare onboarded the version. The blocklist entry at SubTypeValidator.java:144 prevents deserialization of the malicious gadget class, blocking the attack chain before arbitrary code execution can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 does not affect jackson-databind version 2.9.10.8. The vulnerability relates to unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig via Jackson's polymorphic typing mechanism. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) adds this class to the deserialization blocklist in SubTypeValidator.java and was already present in upstream release 2.9.10.8 when TuxCare onboarded it. The target contains the complete defense: the blocklist entry at line 145 and the validation logic that rejects deserialization attempts with a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 does not affect jackson-databind version 2.9.10.8. The vulnerability relates to unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig via Jackson's polymorphic typing mechanism. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) adds this class to the deserialization blocklist in SubTypeValidator.java and was already present in upstream release 2.9.10.8 when TuxCare onboarded it. The target contains the complete defense: the blocklist entry at line 145 and the validation logic that rejects deserialization attempts with a security exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:15.914422+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10.8 is not affected by CVE-2021-20190. The CVE affects jackson-databind versions before 2.9.10.7, and the target is version 2.9.10.8, which already includes the upstream fix. The fix (commit 7dbf51bf by upstream maintainer Tatu Saloranta) adds javax.swing.JTextPane and other gadget classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was present in the upstream 2.9.10.8 release when TuxCare onboarded it. The vulnerable pattern (unblocked deserialization of gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "Target version 2.9.10.8 is not affected by CVE-2021-20190. The CVE affects jackson-databind versions before 2.9.10.7, and the target is version 2.9.10.8, which already includes the upstream fix. The fix (commit 7dbf51bf by upstream maintainer Tatu Saloranta) adds javax.swing.JTextPane and other gadget classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was present in the upstream 2.9.10.8 release when TuxCare onboarded it. The vulnerable pattern (unblocked deserialization of gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:13:36.432303+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:52:00.040792+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.8 is NOT AFFECTED by CVE-2026-54512. The vulnerability specifically targets PolymorphicTypeValidator (PTV), a configurable validation mechanism introduced in jackson-databind 2.10.0. Version 2.9.10.8 predates PTV and uses a fundamentally different validation architecture (SubTypeValidator with hardcoded deny-list). The CVE describes bypassing \"an explicitly configured PTV allow-list\" via generic type parameters\u2014a mechanism that does not exist in 2.9.10.8. The affected component is absent from this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "impact_statement": "Version 2.9.10.8 is NOT AFFECTED by CVE-2026-54512. The vulnerability specifically targets PolymorphicTypeValidator (PTV), a configurable validation mechanism introduced in jackson-databind 2.10.0. Version 2.9.10.8 predates PTV and uses a fundamentally different validation architecture (SubTypeValidator with hardcoded deny-list). The CVE describes bypassing \"an explicitly configured PTV allow-list\" via generic type parameters\u2014a mechanism that does not exist in 2.9.10.8. The affected component is absent from this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:23:53.811682+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "action_statement": "Vulnerability CVE-2026-54515 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T14:23:21.059555+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:10:10.647492+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "action_statement": "Vulnerability CVE-2026-54518 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:38:00.104929+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 specifically affects Java Records with @JsonIgnore annotations when PropertyNamingStrategy is used. The vulnerability allows bypassing @JsonIgnore by using the renamed property key. However, the target version 2.9.10.8 is compiled for Java 7 (javac.src/target=1.7) and completely predates Java Record support, which was only added to jackson-databind in August 2020 (for Java 14+ pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59888 specifically affects Java Records with @JsonIgnore annotations when PropertyNamingStrategy is used. The vulnerability allows bypassing @JsonIgnore by using the renamed property key. However, the target version 2.9.10.8 is compiled for Java 7 (javac.src/target=1.7) and completely predates Java Record support, which was only added to jackson-databind in August 2020 (for Java 14+ pr..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:23:53.811682+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T10:10:10.647492+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:23:53.811682+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T14:11:18.280480+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10.8-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.8-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}