{
  "@id": "urn:uuid:2428defd-9cd3-4e0e-81b7-b899f6e2bccf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 67,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T10:54:00.035453+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2017-15095. The vulnerability affects versions prior to 2.8.11 and 2.9.4, but version 2.10.4 already contains the upstream fix. The blacklist entries for dangerous classes (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, etc.) specified in issue #1737 are present in SubTypeValidator.java, preventing deserialization attacks. The fix was shipped in the upstream 2.10.4 release by author tatu.saloranta@iki.fi before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2017-15095. The vulnerability affects versions prior to 2.8.11 and 2.9.4, but version 2.10.4 already contains the upstream fix. The blacklist entries for dangerous classes (FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, etc.) specified in issue #1737 are present in SubTypeValidator.java, preventing deserialization attacks. The fix was shipped in the upstream 2.10.4 release by author tatu.saloranta@iki.fi before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:46:24.540154+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.4 is not affected by CVE-2017-17485. All fixes for this CVE (GitHub issues #1737 and #1855) were authored by upstream jackson-databind maintainers and shipped in the upstream 2.10.4 release before TuxCare onboarded it. The vulnerable deserialization patterns are not present because the SubTypeValidator with comprehensive blacklist entries is active and properly invoked during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target version 2.10.4 is not affected by CVE-2017-17485. All fixes for this CVE (GitHub issues #1737 and #1855) were authored by upstream jackson-databind maintainers and shipped in the upstream 2.10.4 release before TuxCare onboarded it. The vulnerable deserialization patterns are not present because the SubTypeValidator with comprehensive blacklist entries is active and properly invoked during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:31:31.792596+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability was fixed in upstream jackson-databind via the SubTypeValidator mechanism, which was already included in the 2.10.4 release when TuxCare onboarded it. The target contains a comprehensive blacklist of dangerous classes (InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, ObjectFactory, TemplatesImpl, and many others) and validates all bean deserializations against this blacklist, blocking the arbitrary code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability was fixed in upstream jackson-databind via the SubTypeValidator mechanism, which was already included in the 2.10.4 release when TuxCare onboarded it. The target contains a comprehensive blacklist of dangerous classes (InvokerTransformer, InstantiateTransformer, MethodClosure, ConvertedClosure, ObjectFactory, TemplatesImpl, and many others) and validates all bean deserializations against this blacklist, blocking the arbitrary code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:22:33.360201+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5, allowing data exfiltration via the org.apache.ibatis.parsing.XPathParser gadget class when default typing is enabled. The target version 2.10.4 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in earlier releases by adding XPathParser to the deserialization blacklist. The fix (commit 27b4defc27) was authored by tatu.saloranta@iki.fi and shipped in jackson-databind 2.10.0+, well before the 2.10.4 release that TuxCare onboarded. The fix is present at SubTypeValidator.java:65, where XPathParser is blacklisted with the comment \"data exfiltration via xml parsed ext entities\". The SubTypeValidator is properly integrated into the deserialization flow (BeanDeserializerFactory.java:141, 925) and blocks any attempt to deserialize blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5, allowing data exfiltration via the org.apache.ibatis.parsing.XPathParser gadget class when default typing is enabled. The target version 2.10.4 is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in earlier releases by adding XPathParser to the deserialization blacklist. The fix (commit 27b4defc27) was authored by tatu.saloranta@iki.fi and shipped in jackson-databind 2.10.0+, well before the 2.10.4 release that TuxCare onboarded. The fix is present at SubTypeValidator.java:65, where XPathParser is blacklisted with the comment \"data exfiltration via xml parsed ext entities\". The SubTypeValidator is properly integrated into the deserialization flow (BeanDeserializerFactory.java:141, 925) and blocks any attempt to deserialize blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows polymorphic deserialization of dangerous Jodd-db and Oracle JDBC classes when Default Typing is enabled, enabling LDAP-based remote code execution. The target repository is jackson-databind version 2.10.4-tuxcare.3, which already contains the upstream fix. The fix (commit 28badf7ef6) adds three classes to the SubTypeValidator blacklist: jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. This fix was authored by upstream maintainer Tatu Saloranta and was included in the upstream 2.10.4 release before TuxCare onboarded it. Therefore, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The vulnerability allows polymorphic deserialization of dangerous Jodd-db and Oracle JDBC classes when Default Typing is enabled, enabling LDAP-based remote code execution. The target repository is jackson-databind version 2.10.4-tuxcare.3, which already contains the upstream fix. The fix (commit 28badf7ef6) adds three classes to the SubTypeValidator blacklist: jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet. This fix was authored by upstream maintainer Tatu Saloranta and was included in the upstream 2.10.4 release before TuxCare onboarded it. Therefore, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:22:58.856963+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.10.4-tuxcare.3. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing arbitrary code execution through polymorphic deserialization of Oracle JDBC driver classes when Default Typing is enabled. The target contains the upstream fix (commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a from 2018-06-07) that blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java. This fix was already present in the upstream 2.10.4 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.10.4-tuxcare.3. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6, allowing arbitrary code execution through polymorphic deserialization of Oracle JDBC driver classes when Default Typing is enabled. The target contains the upstream fix (commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a from 2018-06-07) that blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java. This fix was already present in the upstream 2.10.4 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:11.067776+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The fix that blocks org.slf4j.ext.EventData (and related dangerous classes) from polymorphic deserialization is present in SubTypeValidator.java lines 74-78. This fix was authored by upstream maintainer Tatu Saloranta (commit 87d29af25e, dated 2018-08-16) and shipped in the upstream jackson-databind 2.10.4 release that TuxCare onboarded. The vulnerable code pattern is not present because the defense was already built into the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target jackson-databind 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The fix that blocks org.slf4j.ext.EventData (and related dangerous classes) from polymorphic deserialization is present in SubTypeValidator.java lines 74-78. This fix was authored by upstream maintainer Tatu Saloranta (commit 87d29af25e, dated 2018-08-16) and shipped in the upstream jackson-databind 2.10.4 release that TuxCare onboarded. The vulnerable code pattern is not present because the defense was already built into the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:02:59.383624+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for dangerous BlazeDS classes in polymorphic deserialization. The target version 2.10.4-tuxcare.3 already contains the upstream fix (commit 87d29af25e by Tatu Saloranta) that blocks flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related dangerous classes. This fix was part of the upstream release 2.10.4 onboarded by TuxCare, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for dangerous BlazeDS classes in polymorphic deserialization. The target version 2.10.4-tuxcare.3 already contains the upstream fix (commit 87d29af25e by Tatu Saloranta) that blocks flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related dangerous classes. This fix was part of the upstream release 2.10.4 onboarded by TuxCare, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:01.555768+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.10.4-tuxcare.3 is NOT affected by CVE-2018-14720. The upstream fix that blocks the four dangerous classes from polymorphic deserialization (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream version 2.10.4 that TuxCare onboarded. The fix is implemented in SubTypeValidator.java lines 75-78, and the validation logic actively rejects deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target repository jackson-databind 2.10.4-tuxcare.3 is NOT affected by CVE-2018-14720. The upstream fix that blocks the four dangerous classes from polymorphic deserialization (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was already present in the upstream version 2.10.4 that TuxCare onboarded. The fix is implemented in SubTypeValidator.java lines 75-78, and the validation logic actively rejects deserialization of these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:54.716958+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2018-14721. The vulnerability allows SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The fix, which adds \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" to a deserialization blacklist, was already present in the upstream 2.10.4 release that TuxCare onboarded. The vulnerable code pattern is not present because the upstream vendor (Tatu Saloranta) shipped the fix in commit 87d29af before the 2.10.4 release, which occurred after the CVE's stated fixed version (2.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2018-14721. The vulnerability allows SSRF attacks via polymorphic deserialization of the axis2-jaxws class. The fix, which adds \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" to a deserialization blacklist, was already present in the upstream 2.10.4 release that TuxCare onboarded. The vulnerable code pattern is not present because the upstream vendor (Tatu Saloranta) shipped the fix in commit 87d29af before the 2.10.4 release, which occurred after the CVE's stated fixed version (2.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:54:30.943101+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version 2.10.4-tuxcare.3 is NOT affected because the upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in the jackson-databind 2.10.4 release that TuxCare onboarded. The vulnerable class is blocked at line 85 of SubTypeValidator.java, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. The target version 2.10.4-tuxcare.3 is NOT affected because the upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in the jackson-databind 2.10.4 release that TuxCare onboarded. The vulnerable class is blocked at line 85 of SubTypeValidator.java, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:59:33.966848+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability affects versions before 2.9.8, and the upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in the 2.10.4 release that TuxCare onboarded. The SubTypeValidator.java file contains the required blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime that prevent polymorphic deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability affects versions before 2.9.8, and the upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in the 2.10.4 release that TuxCare onboarded. The SubTypeValidator.java file contains the required blocklist entries for org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime that prevent polymorphic deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:27:13.005239+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability concerns missing blocklist entries for dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others) used in polymorphic deserialization gadget chains. The fix was already present in the upstream 2.10.4 release that TuxCare onboarded. SubTypeValidator.java lines 80-86 contain the required blocklist entries added by upstream commit 72cd4025a22 (Fix #2186) authored by Tatu Saloranta on 2018-11-19, which predates the TuxCare onboarding commit 33fa08c13. The blocklist is enforced automatically during polymorphic deserialization through BeanDeserializerFactory line 925.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability concerns missing blocklist entries for dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others) used in polymorphic deserialization gadget chains. The fix was already present in the upstream 2.10.4 release that TuxCare onboarded. SubTypeValidator.java lines 80-86 contain the required blocklist entries added by upstream commit 72cd4025a22 (Fix #2186) authored by Tatu Saloranta on 2018-11-19, which predates the TuxCare onboarding commit 33fa08c13. The blocklist is enforced automatically during polymorphic deserialization through BeanDeserializerFactory line 925.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 addresses two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass jackson-databind's default typing blacklist. The fix adds these classes to the blacklist in SubTypeValidator.java. The target repository at version 2.10.4-tuxcare.3 (SHA 250b625499) already contains this fix - it was shipped in the upstream 2.10.4 release and inherited when TuxCare onboarded the version. The fix commit (038b471e2e) authored by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit (33fa08c13d \"Onboard version 2.10.4\"), confirming it was part of the upstream release. Therefore, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 addresses two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass jackson-databind's default typing blacklist. The fix adds these classes to the blacklist in SubTypeValidator.java. The target repository at version 2.10.4-tuxcare.3 (SHA 250b625499) already contains this fix - it was shipped in the upstream 2.10.4 release and inherited when TuxCare onboarded the version. The fix commit (038b471e2e) authored by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit (33fa08c13d \"Onboard version 2.10.4\"), confirming it was part of the upstream release. Therefore, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:58.947122+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.10.4-tuxcare.3. The vulnerability, which allowed remote code execution via deserialization of malicious c3p0 DataSource classes when default typing is enabled, was fixed in upstream version 2.9.5. The target version 2.10.4 already contains the fix, which was introduced in upstream commit 6799f8f10c by Tatu Saloranta and shipped in the upstream 2.10.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.10.4-tuxcare.3. The vulnerability, which allowed remote code execution via deserialization of malicious c3p0 DataSource classes when default typing is enabled, was fixed in upstream version 2.9.5. The target version 2.10.4 already contains the fix, which was introduced in upstream commit 6799f8f10c by Tatu Saloranta and shipped in the upstream 2.10.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:36:34.248507+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2019-12086. The vulnerability (polymorphic typing issue allowing arbitrary file read via com.mysql.cj.jdbc.admin.MiniAdmin gadget) was fixed in upstream version 2.9.9. The fix was already present in the upstream 2.10.4 release that TuxCare onboarded. The dangerous class \"com.mysql.cj.jdbc.admin.MiniAdmin\" is blocked in SubTypeValidator.java line 88, preventing exploitation. Fix commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 by upstream author tatu.saloranta@iki.fi is an ancestor of the TuxCare onboarding commit, confirming this is an upstream fix that shipped with the original 2.10.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "Target jackson-databind 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2019-12086. The vulnerability (polymorphic typing issue allowing arbitrary file read via com.mysql.cj.jdbc.admin.MiniAdmin gadget) was fixed in upstream version 2.9.9. The fix was already present in the upstream 2.10.4 release that TuxCare onboarded. The dangerous class \"com.mysql.cj.jdbc.admin.MiniAdmin\" is blocked in SubTypeValidator.java line 88, preventing exploitation. Fix commit dda513bd7251b4f32b7b60b1c13740e3b5a43024 by upstream author tatu.saloranta@iki.fi is an ancestor of the TuxCare onboarding commit, confirming this is an upstream fix that shipped with the original 2.10.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T18:44:22.052646+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.10.4-tuxcare.3. The upstream fix (commit c9ef4a10d6) that blocks the dangerous logback-core class 'ch.qos.logback.core.db.DriverManagerConnectionSource' from polymorphic deserialization was already included in the jackson-databind 2.10.4 release before TuxCare onboarded the repository. The blocklist entry at SubTypeValidator.java:91 prevents i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is not present in jackson-databind 2.10.4-tuxcare.3. The upstream fix (commit c9ef4a10d6) that blocks the dangerous logback-core class 'ch.qos.logback.core.db.DriverManagerConnectionSource' from polymorphic deserialization was already included in the jackson-databind 2.10.4 release before TuxCare onboarded the repository. The blocklist entry at SubTypeValidator.java:91 prevents i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T07:25:00.155484+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind version 2.10.4-tuxcare.3 is not affected by CVE-2019-12814. The fix for this vulnerability was already present in the upstream 2.10.4 release that TuxCare onboarded. The fix adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java (lines 94-95), preventing exploitation of JDOM classes via ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind version 2.10.4-tuxcare.3 is not affected by CVE-2019-12814. The fix for this vulnerability was already present in the upstream 2.10.4 release that TuxCare onboarded. The fix adds org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java (lines 94-95), preventing exploitation of JDOM classes via ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involved unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup via polymorphic typing, leading to RCE. The fix (adding DefaultTransactionManagerLookup to SubTypeValidator's denylist) was already present in the upstream 2.10.4 release that TuxCare onboarded. Lines 98-99 of SubTypeValidator.java contain the protective denylist entry, and the validation is enforced on every bean deserialization via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involved unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup via polymorphic typing, leading to RCE. The fix (adding DefaultTransactionManagerLookup to SubTypeValidator's denylist) was already present in the upstream 2.10.4 release that TuxCare onboarded. Lines 98-99 of SubTypeValidator.java contain the protective denylist entry, and the validation is enforced on every bean deserialization via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:39:12.146709+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability concerns polymorphic deserialization of dangerous logback/EHCache classes when Default Typing is enabled. The upstream fix (commit ad418eeb97) added two class names to the deserialization blacklist: ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. This fix was already present in the upstream release 2.10.4 that TuxCare onboarded, as confirmed by checking that the fix commit is an ancestor of the first TuxCare onboarding commit (33fa08c13d). The target code at HEAD contains these blacklist entries at SubTypeValidator.java lines 98 and 102, effectively blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability concerns polymorphic deserialization of dangerous logback/EHCache classes when Default Typing is enabled. The upstream fix (commit ad418eeb97) added two class names to the deserialization blacklist: ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. This fix was already present in the upstream release 2.10.4 that TuxCare onboarded, as confirmed by checking that the fix commit is an ancestor of the first TuxCare onboarding commit (33fa08c13d). The target code at HEAD contains these blacklist entries at SubTypeValidator.java lines 98 and 102, effectively blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:50:26.784780+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Version 2.10.4 is not affected by CVE-2019-14540. The fix (blocklist entries for com.zaxxer.hikari.HikariConfig and HikariDataSource in SubTypeValidator) was already present in the upstream release 2.10.4 that TuxCare onboarded. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3; version 2.10.4 is after these thresholds and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "Version 2.10.4 is not affected by CVE-2019-14540. The fix (blocklist entries for com.zaxxer.hikari.HikariConfig and HikariDataSource in SubTypeValidator) was already present in the upstream release 2.10.4 that TuxCare onboarded. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3; version 2.10.4 is after these thresholds and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:58:58.868131+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involved polymorphic deserialization of malicious objects using commons-configuration JNDI classes (JNDIConfiguration and JNDIConfiguration2) that could lead to arbitrary code execution. The upstream fix added these two class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix is present in the target repository at lines 112-114 of SubTypeValidator.java. The fix was authored by the upstream maintainer (Tatu Saloranta, tatu.saloranta@iki.fi) and shipped in the upstream release jackson-databind 2.10.4, which TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involved polymorphic deserialization of malicious objects using commons-configuration JNDI classes (JNDIConfiguration and JNDIConfiguration2) that could lead to arbitrary code execution. The upstream fix added these two class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix is present in the target repository at lines 112-114 of SubTypeValidator.java. The fix was authored by the upstream maintainer (Tatu Saloranta, tatu.saloranta@iki.fi) and shipped in the upstream release jackson-databind 2.10.4, which TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0 due to a polymorphic deserialization vulnerability involving the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The target version 2.10.4-tuxcare.3 is NOT affected because the upstream fix (commit 998efd7082) was already included in the 2.10.4 release. The dangerous xalan class is blocked at SubTypeValidator.java:117, preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the base 2.10.4 release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0 due to a polymorphic deserialization vulnerability involving the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool). The target version 2.10.4-tuxcare.3 is NOT affected because the upstream fix (commit 998efd7082) was already included in the 2.10.4 release. The dangerous xalan class is blocked at SubTypeValidator.java:117, preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the base 2.10.4 release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:08:31.778572+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, related to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource. The target version 2.10.4-tuxcare.3 already contains the upstream fix: HikariDataSource is present in the SubTypeValidator blocklist at line 107, preventing instantiation during polymorphic deserialization. This fix (commit 73c1c2cc76e) was authored by upstream maintainer Tatu Saloranta on 2019-09-12 and was included in the upstream 2.10.4 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, related to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource. The target version 2.10.4-tuxcare.3 already contains the upstream fix: HikariDataSource is present in the SubTypeValidator blocklist at line 107, preventing instantiation during polymorphic deserialization. This fix (commit 73c1c2cc76e) was authored by upstream maintainer Tatu Saloranta on 2019-09-12 and was included in the upstream 2.10.4 release before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:44.196020+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2019-16942. The vulnerable classes org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource are already blocked in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES (lines 122-123). The fix was authored by upstream maintainer Tatu Saloranta in commits 9593e16cf5 (adding SharedPoolDataSource) and 328a0f833d (adding PerUserPoolDataSource), both of which are ancestors of the first TuxCare commit 33fa08c13d that onboarded version 2.10.4. This is an upstream fix that shipped in the jackson-databind 2.10.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2019-16942. The vulnerable classes org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource are already blocked in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES (lines 122-123). The fix was authored by upstream maintainer Tatu Saloranta in commits 9593e16cf5 (adding SharedPoolDataSource) and 328a0f833d (adding PerUserPoolDataSource), both of which are ancestors of the first TuxCare commit 33fa08c13d that onboarded version 2.10.4. This is an upstream fix that shipped in the jackson-databind 2.10.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:18:37.716688+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.10.4. The vulnerability involves polymorphic deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource) that can lead to arbitrary code execution when Default Typing is enabled. The upstream fix (commits 9593e16cf5, 328a0f833d by Tatu Saloranta, 2019-09-28) added these classes to SubTypeValidator's deserialization blacklist. This fix was included in upstream releases 2.9.10.1 and 2.10.1+. The target version 2.10.4 includes this fix as part of the upstream release that TuxCare onboarded, confirmed by verifying the fix commits are ancestors of the first TuxCare commit (33fa08c13d2 \"Onboard version 2.10.4\"). The blacklist validation in SubTypeValidator.java:122-124 actively blocks deserialization of these classes with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.10.4. The vulnerability involves polymorphic deserialization of dangerous classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, PerUserPoolDataSource) that can lead to arbitrary code execution when Default Typing is enabled. The upstream fix (commits 9593e16cf5, 328a0f833d by Tatu Saloranta, 2019-09-28) added these classes to SubTypeValidator's deserialization blacklist. This fix was included in upstream releases 2.9.10.1 and 2.10.1+. The target version 2.10.4 includes this fix as part of the upstream release that TuxCare onboarded, confirmed by verifying the fix commits are ancestors of the first TuxCare commit (33fa08c13d2 \"Onboard version 2.10.4\"). The blacklist validation in SubTypeValidator.java:122-124 actively blocks deserialization of these classes with error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10, enabling polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository is version 2.10.4-tuxcare.3, which already contains the upstream fix. The blacklist entry blocking this class was added by upstream maintainer Tatu Saloranta in commit 191a4cdf87 (September 19, 2019) and shipped in jackson-databind 2.10.4. TuxCare onboarded this fixed version on September 10, 2026, inheriting the protection. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10, enabling polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository is version 2.10.4-tuxcare.3, which already contains the upstream fix. The blacklist entry blocking this class was added by upstream maintainer Tatu Saloranta in commit 191a4cdf87 (September 19, 2019) and shipped in jackson-databind 2.10.4. TuxCare onboarded this fixed version on September 10, 2026, inheriting the protection. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:50:17.320852+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2019-17531. The vulnerability involves polymorphic deserialization of malicious log4j-extras classes (DriverManagerConnectionSource, JNDIConnectionSource) that could lead to arbitrary code execution via JNDI exploitation when Default Typing is enabled. The vendor's fix adds these two class names to a deserialization blocklist in SubTypeValidator.java. This fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) was authored by upstream maintainer Tatu Saloranta on October 12, 2019, and was already present in the upstream jackson-databind 2.10.4 release before TuxCare onboarded it on September 10, 2026. The blocklist entries at SubTypeValidator.java:126-128 prevent deserialization of the dangerous classes when polymorphic type resolution occurs, effectively blocking the attack chain from INPUT (class name in JSON) to GOAL (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "The target jackson-databind 2.10.4-tuxcare.3 is not affected by CVE-2019-17531. The vulnerability involves polymorphic deserialization of malicious log4j-extras classes (DriverManagerConnectionSource, JNDIConnectionSource) that could lead to arbitrary code execution via JNDI exploitation when Default Typing is enabled. The vendor's fix adds these two class names to a deserialization blocklist in SubTypeValidator.java. This fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0) was authored by upstream maintainer Tatu Saloranta on October 12, 2019, and was already present in the upstream jackson-databind 2.10.4 release before TuxCare onboarded it on September 10, 2026. The blocklist entries at SubTypeValidator.java:126-128 prevent deserialization of the dangerous classes when polymorphic type resolution occurs, effectively blocking the attack chain from INPUT (class name in JSON) to GOAL (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT PRESENT in jackson-databind 2.10.4-tuxcare.3. The fix was already included in the upstream 2.10.4 release that TuxCare onboarded. The two ehcache class names (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector) are present in the deserialization blocklist at lines 131-132 of SubTypeValidator.java. This was an upstream fix by Tatu Saloranta (commit eb254813cc, dated 2020-03-10), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT PRESENT in jackson-databind 2.10.4-tuxcare.3. The fix was already included in the upstream 2.10.4 release that TuxCare onboarded. The two ehcache class names (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and net.sf.ehcache.transaction.manager.selector.GlassfishSelector) are present in the deserialization blocklist at lines 131-132 of SubTypeValidator.java. This was an upstream fix by Tatu Saloranta (commit eb254813cc, dated 2020-03-10), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:06:50.829153+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind before 2.9.10.4 due to unsafe deserialization of ignite-jta classes that can lead to arbitrary code execution. The vulnerability is NOT PRESENT in the target jackson-databind 2.10.4-tuxcare.3. The fix (commit a424c038ba) was already included in the upstream 2.10.4 release that TuxCare onboarded. The target code contains the required blacklist entries for org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup and CacheJndiTmFactory at lines 152-153 of SubTypeValidator.java, which blocks deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind before 2.9.10.4 due to unsafe deserialization of ignite-jta classes that can lead to arbitrary code execution. The vulnerability is NOT PRESENT in the target jackson-databind 2.10.4-tuxcare.3. The fix (commit a424c038ba) was already included in the upstream 2.10.4 release that TuxCare onboarded. The target code contains the required blacklist entries for org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup and CacheJndiTmFactory at lines 152-153 of SubTypeValidator.java, which blocks deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4 is NOT AFFECTED by CVE-2020-10672. The vulnerability involves a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory) that enables arbitrary code execution through Jackson's polymorphic type handling. The fix was already present in the upstream 2.10.4 release that TuxCare onboarded. Commit 592872f4235c7f2a3280725278da55544032f72d (authored by upstream maintainer Tatu Saloranta on March 15, 2020) added both vulnerable classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This commit is an ancestor of the first TuxCare onboarding commit (33fa08c1), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target jackson-databind 2.10.4 is NOT AFFECTED by CVE-2020-10672. The vulnerability involves a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory) that enables arbitrary code execution through Jackson's polymorphic type handling. The fix was already present in the upstream 2.10.4 release that TuxCare onboarded. Commit 592872f4235c7f2a3280725278da55544032f72d (authored by upstream maintainer Tatu Saloranta on March 15, 2020) added both vulnerable classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This commit is an ancestor of the first TuxCare onboarding commit (33fa08c1), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:30:36.061493+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (com.caucho.config.types.ResourceRef). The target repository is jackson-databind 2.10.4-tuxcare.3. The fix (commit 1645efbd39) that adds ResourceRef to the deserialization blacklist is present at line 161 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream jackson-databind 2.10.4 release that TuxCare onboarded. Since the fix predates TuxCare's maintenance (onboarding commit 33fa08c13d), this is an upstream fix, not a TuxCare backport. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (com.caucho.config.types.ResourceRef). The target repository is jackson-databind 2.10.4-tuxcare.3. The fix (commit 1645efbd39) that adds ResourceRef to the deserialization blacklist is present at line 161 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream jackson-databind 2.10.4 release that TuxCare onboarded. Since the fix predates TuxCare's maintenance (onboarding commit 33fa08c13d), this is an upstream fix, not a TuxCare backport. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target version 2.10.4-tuxcare.3 already contains the upstream fix (commit 05d7e0e1) that adds this class to the deserialization blocklist in SubTypeValidator.java (lines 164-165). This fix was present in the upstream release 2.10.4 before TuxCare onboarded it, as evidenced by the fix commit being an ancestor of the first TuxCare onboarding commit (33fa08c1). The vulnerable gadget class cannot be deserialized in the target because SubTypeValidator blocks it at lines 221-255, throwing a security exception. The target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target version 2.10.4-tuxcare.3 already contains the upstream fix (commit 05d7e0e1) that adds this class to the deserialization blocklist in SubTypeValidator.java (lines 164-165). This fix was present in the upstream release 2.10.4 before TuxCare onboarded it, as evidenced by the fix commit being an ancestor of the first TuxCare onboarding commit (33fa08c1). The vulnerable gadget class cannot be deserialized in the target because SubTypeValidator blocks it at lines 221-255, throwing a security exception. The target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 and involves javax.swing.JEditorPane deserialization gadgets. The target repository (version 2.10.4-tuxcare.3) already contains the upstream fix that blacklists javax.swing.JEditorPane in SubTypeValidator.java. This fix was part of the upstream 2.10.4 release, not a TuxCare backport. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 and involves javax.swing.JEditorPane deserialization gadgets. The target repository (version 2.10.4-tuxcare.3) already contains the upstream fix that blacklists javax.swing.JEditorPane in SubTypeValidator.java. This fix was part of the upstream 2.10.4 release, not a TuxCare backport. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target is NOT AFFECTED by CVE-2020-11111. The vulnerability concerns jackson-databind's polymorphic deserialization allowing RCE through ActiveMQ connection factory gadget classes. The upstream vendor (Tatu Saloranta) fixed this in commits 05d7e0e13f and c14c9f99ed by adding 9 ActiveMQ classes to the deserialization blocklist in SubTypeValidator.java. Both commits were included in the upstream 2.10.4 release that TuxCare onboarded (first TuxCare commit: 33fa08c13d \"Onboard version 2.10.4\"). The target's SubTypeValidator.java (lines 167-177) contains all 9 ActiveMQ classes in the DEFAULT_NO_DESER_CLASS_NAMES blocklist, and the validateSubType method (line 221) actively rejects deserialization of these classes before any dangerous object instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target is NOT AFFECTED by CVE-2020-11111. The vulnerability concerns jackson-databind's polymorphic deserialization allowing RCE through ActiveMQ connection factory gadget classes. The upstream vendor (Tatu Saloranta) fixed this in commits 05d7e0e13f and c14c9f99ed by adding 9 ActiveMQ classes to the deserialization blocklist in SubTypeValidator.java. Both commits were included in the upstream 2.10.4 release that TuxCare onboarded (first TuxCare commit: 33fa08c13d \"Onboard version 2.10.4\"). The target's SubTypeValidator.java (lines 167-177) contains all 9 ActiveMQ classes in the DEFAULT_NO_DESER_CLASS_NAMES blocklist, and the validateSubType method (line 221) actively rejects deserialization of these classes before any dangerous object instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (commit 05d7e0e13f by upstream maintainer Tatu Saloranta on 2020-03-25) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.10.4 release that TuxCare onboarded. The blocklist entry exists at line 180 of SubTypeValidator.java, preventing exploitation of this gadget chain. Target version 2.10.4 is after the affected range (before 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involves deserialization of the dangerous gadget class org.apache.commons.proxy.provider.remoting.RmiProvider. The fix (commit 05d7e0e13f by upstream maintainer Tatu Saloranta on 2020-03-25) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.10.4 release that TuxCare onboarded. The blocklist entry exists at line 180 of SubTypeValidator.java, preventing exploitation of this gadget chain. Target version 2.10.4 is after the affected range (before 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.10.4-tuxcare.3) is not affected by CVE-2020-11113. The vulnerability involves deserialization of the malicious gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime, but this class is already blacklisted in SubTypeValidator.java at line 84. The fix was authored by upstream maintainer Tatu Saloranta (commit e2ba12d5d60) and was included in the upstream 2.10.4 release before TuxCare's onboarding. The CVE affects versions before 2.9.10.4, and the target version 2.10.4 is later than the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target repository (jackson-databind 2.10.4-tuxcare.3) is not affected by CVE-2020-11113. The vulnerability involves deserialization of the malicious gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime, but this class is already blacklisted in SubTypeValidator.java at line 84. The fix was authored by upstream maintainer Tatu Saloranta (commit e2ba12d5d60) and was included in the upstream 2.10.4 release before TuxCare's onboarding. The CVE affects versions before 2.9.10.4, and the target version 2.10.4 is later than the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.10.4 is NOT AFFECTED. The CVE-2020-11619 fix blocking deserialization of MethodLocatingFactoryBean and BeanReferenceFactoryBean gadget classes was already present in the upstream 2.10.4 release that TuxCare onboarded. The defense is functional and integrated into production deserialization via SubTypeValidator.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "Target jackson-databind 2.10.4 is NOT AFFECTED. The CVE-2020-11619 fix blocking deserialization of MethodLocatingFactoryBean and BeanReferenceFactoryBean gadget classes was already present in the upstream 2.10.4 release that TuxCare onboarded. The defense is functional and integrated into production deserialization via SubTypeValidator.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4/2.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.10.4-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 77040d85e3) was already present in the upstream 2.10.4 release that TuxCare onboarded. The fix adds org.apache.commons.jelly.impl.Embedded to the SubTypeValidator blocklist, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4/2.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.10.4-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 77040d85e3) was already present in the upstream 2.10.4 release that TuxCare onboarded. The fix adds org.apache.commons.jelly.impl.Embedded to the SubTypeValidator blocklist, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind 2.x before 2.9.10.5. Target version 2.10.4-tuxcare.3 already contains the upstream fix. The blacklist entry for oadd.org.apache.xalan.lib.sql.JNDIConnectionPool is present at SubTypeValidator.java:186, added by upstream commit d1c67a0396e (author: tatu.saloranta@iki.fi, 2020-04-24). This fix was part of the upstream 2.10.4 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind 2.x before 2.9.10.5. Target version 2.10.4-tuxcare.3 already contains the upstream fix. The blacklist entry for oadd.org.apache.xalan.lib.sql.JNDIConnectionPool is present at SubTypeValidator.java:186, added by upstream commit d1c67a0396e (author: tatu.saloranta@iki.fi, 2020-04-24). This fix was part of the upstream 2.10.4 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind versions before 2.9.10.5. The target repository is version 2.10.4-tuxcare.3, which already contains the upstream fix from commit 5c8642aeae. The fix adds five oracle.jms.AQjms* class names to the deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java, preventing their instantiation during JSON deserialization with polymorphic typing. This fix was already present in the upstream release 2.10.4 before TuxCare onboarded it, as confirmed by commit ancestry analysis showing the fix commit predates the first TuxCare onboarding commit (33fa08c13d). The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 affects jackson-databind versions before 2.9.10.5. The target repository is version 2.10.4-tuxcare.3, which already contains the upstream fix from commit 5c8642aeae. The fix adds five oracle.jms.AQjms* class names to the deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java, preventing their instantiation during JSON deserialization with polymorphic typing. This fix was already present in the upstream release 2.10.4 before TuxCare onboarded it, as confirmed by commit ancestry analysis showing the fix commit predates the first TuxCare onboarding commit (33fa08c13d). The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2020-14062. The vulnerability (missing blocklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget) was already fixed in upstream jackson-databind 2.10.4 before TuxCare onboarded it. The fix (commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta) added the xalan2 gadget to SubTypeValidator's blocklist, preventing deserialization-based JNDI injection attacks. The defense is present in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:119.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "Target version 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2020-14062. The vulnerability (missing blocklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool gadget) was already fixed in upstream jackson-databind 2.10.4 before TuxCare onboarded it. The fix (commit 840eae2ca81c597a0010b2126f32dce17d384b70 by Tatu Saloranta) added the xalan2 gadget to SubTypeValidator's blocklist, preventing deserialization-based JNDI injection attacks. The defense is present in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:119.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T10:54:00.035453+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "action_statement": "Vulnerability CVE-2020-14195 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "action_statement": "Vulnerability CVE-2020-24616 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T10:54:00.035453+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "action_statement": "Vulnerability CVE-2020-24750 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "action_statement": "Vulnerability CVE-2020-36184 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.10.4. The fix blocking org.apache.xbean.propertyeditor.JndiConverter was already included in the upstream release 2.10.4 (released 03-May-2020), which incorporated the fix from 2.9.10.3 (released 23-Feb-2020). The dangerous gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:135 and is actively enforced during polymorphic deserialization at line 221, preventing exploitation of the JNDI injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.10.4. The fix blocking org.apache.xbean.propertyeditor.JndiConverter was already included in the upstream release 2.10.4 (released 03-May-2020), which incorporated the fix from 2.9.10.3 (released 23-Feb-2020). The dangerous gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:135 and is actively enforced during polymorphic deserialization at line 221, preventing exploitation of the JNDI injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig gadget class. The vendor fix adds this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 137-138), preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 9f4e97019f) and was included in the upstream jackson-databind 2.10.4 release before TuxCare onboarded that version (onboarding commit 33fa08c13d). The target inherited the fix from upstream, making it not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involves unsafe deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig gadget class. The vendor fix adds this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 137-138), preventing its instantiation during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 9f4e97019f) and was included in the upstream jackson-databind 2.10.4 release before TuxCare onboarded that version (onboarding commit 33fa08c13d). The target inherited the fix from upstream, making it not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:43:48.993875+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involves unsafe deserialization of the ibatis-sqlmap gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The vendor patch adds this class to a blocklist in SubTypeValidator.java. The target already contains this fix at lines 141-142 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9f4e97019f, which was already present in the upstream release 2.10.4 before TuxCare's onboarding commit 33fa08c13d. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.10.4-tuxcare.3. The vulnerability involves unsafe deserialization of the ibatis-sqlmap gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The vendor patch adds this class to a blocklist in SubTypeValidator.java. The target already contains this fix at lines 141-142 of SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 9f4e97019f, which was already present in the upstream release 2.10.4 before TuxCare's onboarding commit 33fa08c13d. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:47.656427+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2020-9548. The vulnerability involves deserialization of the malicious gadget class br.com.anteros.dbcp.AnterosDBCPConfig, which the vendor patches block by adding it to a class blocklist. This fix was already present in the upstream jackson-databind 2.10.4 release that TuxCare onboarded (commit 33fa08c13d, \"Onboard version 2.10.4\"). The fix commit 9f4e97019f by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the TuxCare onboarding commit, meaning the vulnerable code pattern never existed in this target version. The blocklist entry is present at SubTypeValidator.java:142 and is enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "The target jackson-databind 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2020-9548. The vulnerability involves deserialization of the malicious gadget class br.com.anteros.dbcp.AnterosDBCPConfig, which the vendor patches block by adding it to a class blocklist. This fix was already present in the upstream jackson-databind 2.10.4 release that TuxCare onboarded (commit 33fa08c13d, \"Onboard version 2.10.4\"). The fix commit 9f4e97019f by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) is an ancestor of the TuxCare onboarding commit, meaning the vulnerable code pattern never existed in this target version. The blocklist entry is present at SubTypeValidator.java:142 and is enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind 2.10.4 is not affected by CVE-2023-35116 in its own codebase. The vulnerability (unbounded nesting depth during serialization) exists in jackson-core's JsonGenerator implementations, which jackson-databind declares as a dependency. The fix (StreamWriteConstraints with nesting depth validation) is applied to jackson-core, not jackson-databind. jackson-databind contains no vendor...",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "impact_statement": "not_affected \u2014 jackson-databind 2.10.4 is not affected by CVE-2023-35116 in its own codebase. The vulnerability (unbounded nesting depth during serialization) exists in jackson-core's JsonGenerator implementations, which jackson-databind declares as a dependency. The fix (StreamWriteConstraints with nesting depth validation) is applied to jackson-core, not jackson-databind. jackson-databind contains no vendor..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:52.704033+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:46:00.086740+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T02:09:41.366702+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54518 describes a @JsonView bypass in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() when @JsonUnwrapped is used with @JsonCreator parameters. Version 2.10.4 does not contain this vulnerable code path - the entire feature (@JsonUnwrapped support for creator parameters) was not introduced until version 2.19 (commit 502fe888da, 2024-11-13). The processUnwrappedCreatorProper...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54518 describes a @JsonView bypass in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() when @JsonUnwrapped is used with @JsonCreator parameters. Version 2.10.4 does not contain this vulnerable code path - the entire feature (@JsonUnwrapped support for creator parameters) was not introduced until version 2.19 (commit 502fe888da, 2024-11-13). The processUnwrappedCreatorProper..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:44:26.266321+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2026-59888. The vulnerability is specific to Java Records with @JsonIgnore annotations interacting with PropertyNamingStrategy. Java Records support was added to jackson-databind in version 2.12.0+ (confirmed by git commit dd2ed05fff \"Fixed #2709 (java.util.Record support!)\"). Target version 2.10.4 predates Record support by 2 major versions, comp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 Version 2.10.4-tuxcare.3 is NOT AFFECTED by CVE-2026-59888. The vulnerability is specific to Java Records with @JsonIgnore annotations interacting with PropertyNamingStrategy. Java Records support was added to jackson-databind in version 2.12.0+ (confirmed by git commit dd2ed05fff \"Fixed #2709 (java.util.Record support!)\"). Target version 2.10.4 predates Record support by 2 major versions, comp..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:53:36.275404+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:53:36.275404+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:45:56.309955+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:54:14.700427+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:54:14.700427+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.4-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T13:01:47.785044+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.10.4-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.10.4-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}