{
  "@id": "urn:uuid:11f82ed7-7339-433b-ae9f-148e8016c856",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 75,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T09:10:50.766711+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:45.482707+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.5.1 is NOT affected by CVE-2017-15095. The vulnerability was fixed in upstream versions 2.8.11 (Dec 2017) and 2.9.4 (Jan 2018) by adding dangerous classes to a deserialization blacklist. The target version 2.10.5.1 (Dec 2020), being much later than the fixed versions, already contains all the blacklist entries introduced by the upstream patches. The fix was shipped in the upstream release that TuxCare onboarded; no backport was needed. The vulnerable code pattern (unrestricted polymorphic deserialization of gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "The target jackson-databind 2.10.5.1 is NOT affected by CVE-2017-15095. The vulnerability was fixed in upstream versions 2.8.11 (Dec 2017) and 2.9.4 (Jan 2018) by adding dangerous classes to a deserialization blacklist. The target version 2.10.5.1 (Dec 2020), being much later than the fixed versions, already contains all the blacklist entries introduced by the upstream patches. The fix was shipped in the upstream release that TuxCare onboarded; no backport was needed. The vulnerable code pattern (unrestricted polymorphic deserialization of gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:41:47.392844+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.10.5.1-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability (incomplete blacklist allowing remote code execution via Spring framework types and other dangerous classes during polymorphic deserialization) was fixed in the upstream jackson-databind 2.10.5.1 release. The fixes, authored by Tatu Saloranta (upstream maintainer) in December 2017, introduce SubTypeValidator with enhanced blacklist checking for dangerous classes including Spring framework types (AbstractPointcutAdvisor, AbstractApplicationContext subclasses). These fixes were already present when TuxCare onboarded version 2.10.5.1, so the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "The target jackson-databind version 2.10.5.1-tuxcare.3 is not affected by CVE-2017-17485. The vulnerability (incomplete blacklist allowing remote code execution via Spring framework types and other dangerous classes during polymorphic deserialization) was fixed in the upstream jackson-databind 2.10.5.1 release. The fixes, authored by Tatu Saloranta (upstream maintainer) in December 2017, introduce SubTypeValidator with enhanced blacklist checking for dangerous classes including Spring framework types (AbstractPointcutAdvisor, AbstractApplicationContext subclasses). These fixes were already present when TuxCare onboarded version 2.10.5.1, so the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:25:36.969179+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability affects versions before 2.6.7.1, 2.7.9.1, and 2.8.9, but version 2.10.5.1 already contains the upstream vendor fix. The fix was shipped in the upstream 2.10.5.1 release via the SubTypeValidator class, which blocks deserialization of dangerous gadget classes that could lead to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability affects versions before 2.6.7.1, 2.7.9.1, and 2.8.9, but version 2.10.5.1 already contains the upstream vendor fix. The fix was shipped in the upstream 2.10.5.1 release via the SubTypeValidator class, which blocks deserialization of dangerous gadget classes that could lead to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:14:44.515379+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.10.5.1-tuxcare.2. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was already included in upstream release 2.10.5.1 before TuxCare's onboarding. The vulnerable pattern (missing blacklist entry) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.10.5.1-tuxcare.2. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was already included in upstream release 2.10.5.1 before TuxCare's onboarding. The vulnerable pattern (missing blacklist entry) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:16:29.149062+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 does not affect jackson-databind 2.10.5.1. The vulnerability concerns unsafe deserialization of Jodd-db and Oracle JDBC classes when Default Typing is enabled, allowing LDAP-based RCE. The fix (blocklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet) is present at SubTypeValidator.java lines 67-72. This fix was authored by upstream maintainer Tatu Saloranta (commit 7487cf7eb14) and was already included in the upstream 2.10.5.1 release before TuxCare onboarding (1507 commits prior to first TuxCare commit 612dbc8ae3b). Target version 2.10.5.1 is well beyond the affected version ranges (< 2.7.9.4, < 2.8.11.2, < 2.9.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 does not affect jackson-databind 2.10.5.1. The vulnerability concerns unsafe deserialization of Jodd-db and Oracle JDBC classes when Default Typing is enabled, allowing LDAP-based RCE. The fix (blocklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet) is present at SubTypeValidator.java lines 67-72. This fix was authored by upstream maintainer Tatu Saloranta (commit 7487cf7eb14) and was already included in the upstream 2.10.5.1 release before TuxCare onboarding (1507 commits prior to first TuxCare commit 612dbc8ae3b). Target version 2.10.5.1 is well beyond the affected version ranges (< 2.7.9.4, < 2.8.11.2, < 2.9.6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:18:43.675482+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 due to unsafe polymorphic deserialization of Oracle JDBC classes when Default Typing is enabled. The target version 2.10.5.1-tuxcare.3 is not affected because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.10.0+ by adding oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist. The fix was present in the upstream 2.10.5.1 release that TuxCare onboarded, as evidenced by commit 28badf7ef6 being an ancestor of the first TuxCare onboarding commit 612dbc8ae3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 due to unsafe polymorphic deserialization of Oracle JDBC classes when Default Typing is enabled. The target version 2.10.5.1-tuxcare.3 is not affected because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.10.0+ by adding oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet to the SubTypeValidator blacklist. The fix was present in the upstream 2.10.5.1 release that TuxCare onboarded, as evidenced by commit 28badf7ef6 being an ancestor of the first TuxCare onboarding commit 612dbc8ae3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:14.640121+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.5.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The fix blocking polymorphic deserialization of org.slf4j.ext.EventData and related classes was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java lines 74-78 and is enforced via BeanDeserializerFactory._validateSubType (line 141), which delegates to SubTypeValidator.instance().validateSubType (line 925). This upstream fix (commit 87d29af25e by Tatu Saloranta) prevents the arbitrary code execution vulnerability by rejecting dangerous classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target jackson-databind 2.10.5.1-tuxcare.3 is NOT AFFECTED by CVE-2018-14718. The fix blocking polymorphic deserialization of org.slf4j.ext.EventData and related classes was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java lines 74-78 and is enforced via BeanDeserializerFactory._validateSubType (line 141), which delegates to SubTypeValidator.instance().validateSubType (line 925). This upstream fix (commit 87d29af25e by Tatu Saloranta) prevents the arbitrary code execution vulnerability by rejecting dangerous classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:36.777269+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.10.5.1. The vulnerability concerns unsafe polymorphic deserialization of BlazeDS classes (flex.messaging.*) that could lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 87d29af25e (Aug 2018) by adding dangerous classes to a deserialization blocklist. This fix was already present in the upstream release 2.10.5.1 (released Sep 2020) that TuxCare onboarded. The target contains the fix at SubTypeValidator.java:74-78, where flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related gadget classes are blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.10.5.1. The vulnerability concerns unsafe polymorphic deserialization of BlazeDS classes (flex.messaging.*) that could lead to remote code execution. The upstream vendor (FasterXML) fixed this in commit 87d29af25e (Aug 2018) by adding dangerous classes to a deserialization blocklist. This fix was already present in the upstream release 2.10.5.1 (released Sep 2020) that TuxCare onboarded. The target contains the fix at SubTypeValidator.java:74-78, where flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related gadget classes are blocked from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:05:55.116892+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous JDK/3rd-party classes that could enable XXE and other attacks. The upstream vendor (FasterXML) fixed this in commit 87d29af25e by blacklisting these classes. This fix was already present in upstream release 2.10.5.1 (tagged jackson-databind-2.10.5.1) before TuxCare onboarded the version. The target version contains all four blacklisted classes in SubTypeValidator.java:75-78, preventing their deserialization. Target version 2.10.5.1 is after the CVE's stated affected range (before 2.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous JDK/3rd-party classes that could enable XXE and other attacks. The upstream vendor (FasterXML) fixed this in commit 87d29af25e by blacklisting these classes. This fix was already present in upstream release 2.10.5.1 (tagged jackson-databind-2.10.5.1) before TuxCare onboarded the version. The target version contains all four blacklisted classes in SubTypeValidator.java:75-78, preventing their deserialization. Target version 2.10.5.1 is after the CVE's stated affected range (before 2.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:33:43.598820+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class enabling SSRF attacks. The upstream fix (commit 0899726ec34 by Tatu Saloranta, 2018-08-16) added this class to the deserialization blacklist in SubTypeValidator.java at line 78. This fix was already present in upstream version 2.10.5.1 when TuxCare onboarded it (commit 612dbc8ae). The SubTypeValidator.validateSubType() method actively enforces the blacklist during deserialization via BeanDeserializerFactory (line 925), preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl class enabling SSRF attacks. The upstream fix (commit 0899726ec34 by Tatu Saloranta, 2018-08-16) added this class to the deserialization blacklist in SubTypeValidator.java at line 78. This fix was already present in upstream version 2.10.5.1 when TuxCare onboarded it (commit 612dbc8ae). The SubTypeValidator.validateSubType() method actively enforces the blacklist during deserialization via BeanDeserializerFactory (line 925), preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:41:38.446812+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.10.5.1. The vulnerability concerns polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, dated 2018-11-19) added this class to the blocklist in SubTypeValidator.java. This fix was already included in the upstream release 2.10.5.1 that TuxCare onboarded on 2026-09-20. The target contains the complete defense at line 85 of SubTypeValidator.java, which blocks deserialization of this dangerous class during polymorphic deserialization. The CVE states versions \"before 2.9.8\" are affected; version 2.10.5.1 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.10.5.1. The vulnerability concerns polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, dated 2018-11-19) added this class to the blocklist in SubTypeValidator.java. This fix was already included in the upstream release 2.10.5.1 that TuxCare onboarded on 2026-09-20. The target contains the complete defense at line 85 of SubTypeValidator.java, which blocks deserialization of this dangerous class during polymorphic deserialization. The CVE states versions \"before 2.9.8\" are affected; version 2.10.5.1 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:54:53.626272+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 addresses the failure to block org.apache.openjpa.ee classes from polymorphic deserialization in jackson-databind. The target repository version 2.10.5.1 already contains the upstream fix that adds these classes to the deserialization blocklist in SubTypeValidator.java (lines 82-83). The fix was authored by upstream maintainer Tatu Saloranta in commit 42912cac (November 2018) and was included in the upstream release 2.10.5.1 that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 addresses the failure to block org.apache.openjpa.ee classes from polymorphic deserialization in jackson-databind. The target repository version 2.10.5.1 already contains the upstream fix that adds these classes to the deserialization blocklist in SubTypeValidator.java (lines 82-83). The fix was authored by upstream maintainer Tatu Saloranta in commit 42912cac (November 2018) and was included in the upstream release 2.10.5.1 that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:24:04.222754+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.10.5.1. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream vendor (FasterXML) fixed this in commit 72cd4025a2 by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was included in upstream release 2.10.5.1, which TuxCare later onboarded. The target code at HEAD contains the fix (SubTypeValidator.java line 81), making polymorphic deserialization of DocumentEditor impossible. The vulnerable pattern is absent because the upstream fix shipped in the release version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.10.5.1. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream vendor (FasterXML) fixed this in commit 72cd4025a2 by adding the class to a deserialization blocklist in SubTypeValidator.java. This fix was included in upstream release 2.10.5.1, which TuxCare later onboarded. The target code at HEAD contains the fix (SubTypeValidator.java line 81), making polymorphic deserialization of DocumentEditor impossible. The vulnerable pattern is absent because the upstream fix shipped in the release version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.10.5.1 is NOT vulnerable. The fix was shipped in upstream release 2.10.0 (commit 038b471e2ef by Tatu Saloranta on 2018-01-21), adding both gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. TuxCare onboarded version 2.10.5.1 via commit 612dbc8ae (2024-07-15), inheriting the upstream fix. The blacklist entries are present at lines 62-63 and actively prevent deserialization of the exploit classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3 via two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.10.5.1 is NOT vulnerable. The fix was shipped in upstream release 2.10.0 (commit 038b471e2ef by Tatu Saloranta on 2018-01-21), adding both gadget classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. TuxCare onboarded version 2.10.5.1 via commit 612dbc8ae (2024-07-15), inheriting the upstream fix. The blacklist entries are present at lines 62-63 and actively prevent deserialization of the exploit classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:37:41.470053+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.5.1-tuxcare.3 is NOT affected by CVE-2018-7489. The fix for this vulnerability (blocking c3p0 DataSource gadget deserialization) was already present in the upstream 2.10.5.1 release that TuxCare onboarded. The vulnerable pattern (unrestricted deserialization of com.mchange.v2.c3p0.*DataSource classes) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "The target jackson-databind 2.10.5.1-tuxcare.3 is NOT affected by CVE-2018-7489. The fix for this vulnerability (blocking c3p0 DataSource gadget deserialization) was already present in the upstream 2.10.5.1 release that TuxCare onboarded. The vulnerable pattern (unrestricted deserialization of com.mchange.v2.c3p0.*DataSource classes) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:30:36.061493+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.10.5.1 already contains the upstream fix that blocklists com.mysql.cj.jdbc.admin.MiniAdmin, preventing polymorphic deserialization of this gadget class. The fix (commit dda513bd7251b4f32b7b60b1c13740e3b5a43024) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.10.5.1 when TuxCare onboarded it. The blocklist is enforced by SubTypeValidator.validateSubType() which throws a JsonMappingException when blocked classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind 2.x before 2.9.9. The target version 2.10.5.1 already contains the upstream fix that blocklists com.mysql.cj.jdbc.admin.MiniAdmin, preventing polymorphic deserialization of this gadget class. The fix (commit dda513bd7251b4f32b7b60b1c13740e3b5a43024) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream release 2.10.5.1 when TuxCare onboarded it. The blocklist is enforced by SubTypeValidator.validateSubType() which throws a JsonMappingException when blocked classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T18:26:04.732148+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1. The target repository is version 2.10.5.1-tuxcare.3, which already contains the upstream fix. The vulnerable class ch.qos.logback.core.db.DriverManagerConnectionSource is blacklisted in SubTypeValidator.java (line 91), preventing polymorphic deserialization. This fix was authored by upstream developer Tatu Saloranta and shipped in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1. The target repository is version 2.10.5.1-tuxcare.3, which already contains the upstream fix. The vulnerable class ch.qos.logback.core.db.DriverManagerConnectionSource is blacklisted in SubTypeValidator.java (line 91), preventing polymorphic deserialization. This fix was authored by upstream developer Tatu Saloranta and shipped in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T07:07:12.795755+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that enable arbitrary file reads when Default Typing is enabled. The upstream fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deser...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that enable arbitrary file reads when Default Typing is enabled. The upstream fix (commit 5f7c69bba07a7155adde130d9dee2e54a54f1fa5 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deser..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:04:03.421384+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target version 2.10.5.1 is not affected by CVE-2019-14379. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource classes. The fix (blocklisting these classes in SubTypeValidator) was already present in the upstream jackson-databind 2.10.5.1 release, applied by upstream author Tatu Saloranta in commit ad418eeb.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target version 2.10.5.1 is not affected by CVE-2019-14379. The vulnerability involves unsafe deserialization of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource classes. The fix (blocklisting these classes in SubTypeValidator) was already present in the upstream jackson-databind 2.10.5.1 release, applied by upstream author Tatu Saloranta in commit ad418eeb.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:29:29.992370+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2019-14439. The fix that adds `ch.qos.logback.core.db.JNDIConnectionSource` to the deny-list in SubTypeValidator.java was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The fix commit (ad418eeb974) was authored by FasterXML maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-07-25 and is an ancestor of TuxCare's onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "The target jackson-databind version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2019-14439. The fix that adds `ch.qos.logback.core.db.JNDIConnectionSource` to the deny-list in SubTypeValidator.java was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The fix commit (ad418eeb974) was authored by FasterXML maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-07-25 and is an ancestor of TuxCare's onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:46.608372+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The upstream vendor (FasterXML) already fixed this vulnerability in commits d4983c740 and 73c1c2cc7 by adding com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blocklist. These fixes were included in the upstream 2.10.5.1 release that TuxCare onboarded, appearing 1,457 commits before TuxCare's first commit. The target repository contains both blocklist entries (SubTypeValidator.java lines 105 and 107), preventing polymorphic deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The upstream vendor (FasterXML) already fixed this vulnerability in commits d4983c740 and 73c1c2cc7 by adding com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blocklist. These fixes were included in the upstream 2.10.5.1 release that TuxCare onboarded, appearing 1,457 commits before TuxCare's first commit. The target repository contains both blocklist entries (SubTypeValidator.java lines 105 and 107), preventing polymorphic deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:53:25.637541+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.5.1 is not affected by CVE-2019-14892. The vulnerability involves polymorphic deserialization of malicious objects using commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration). The upstream fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream version 2.10.0 (September 2019), predating the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "Target version 2.10.5.1 is not affected by CVE-2019-14892. The vulnerability involves polymorphic deserialization of malicious objects using commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration). The upstream fix, which adds these classes to a deserialization blocklist in SubTypeValidator.java, was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in upstream version 2.10.0 (September 2019), predating the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind version 2.10.5.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool). The fix blocking this class was already included in the upstream release 2.10.5.1 before TuxCare onboarded this version. The fix commit (998efd708284778f29d83d7962a9bd935c228317) was authored by upstream maintainer Tatu Saloranta on September 19, 2019, and is present in the target's SubTypeValidator.java at line 117. The target version is after the affected versions stated in the CVE (\"before 2.9.10 and 2.10.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind version 2.10.5.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool). The fix blocking this class was already included in the upstream release 2.10.5.1 before TuxCare onboarded this version. The fix commit (998efd708284778f29d83d7962a9bd935c228317) was authored by upstream maintainer Tatu Saloranta on September 19, 2019, and is present in the target's SubTypeValidator.java at line 117. The target version is after the affected versions stated in the CVE (\"before 2.9.10 and 2.10.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:02:54.812243+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 addresses a polymorphic deserialization gadget vulnerability involving com.zaxxer.hikari.HikariDataSource. The fix (adding HikariDataSource to SubTypeValidator's blocklist) is present in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:107. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 73c1c2cc76e and shipped in upstream release 2.10.0, which predates TuxCare's onboarding of version 2.10.5.1. The target was never vulnerable in its shipped state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 addresses a polymorphic deserialization gadget vulnerability involving com.zaxxer.hikari.HikariDataSource. The fix (adding HikariDataSource to SubTypeValidator's blocklist) is present in the target at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:107. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 73c1c2cc76e and shipped in upstream release 2.10.0, which predates TuxCare's onboarding of version 2.10.5.1. The target was never vulnerable in its shipped state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:02:16.356690+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves deserialization gadgets using commons-dbcp classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) to achieve arbitrary code execution when Default Typing is enabled. The upstream FasterXML project fixed this in commits 9593e16cf5 and 328a0f833d by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.10.5.1 release that TuxCare onboarded (commit 612dbc8ae3), making the target version not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves deserialization gadgets using commons-dbcp classes (org.apache.commons.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) to achieve arbitrary code execution when Default Typing is enabled. The upstream FasterXML project fixed this in commits 9593e16cf5 and 328a0f833d by adding these classes to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.10.5.1 release that TuxCare onboarded (commit 612dbc8ae3), making the target version not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:13:05.282153+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is a polymorphic typing vulnerability in jackson-databind that allows attackers to execute malicious payloads when Default Typing is enabled by deserializing dangerous gadget classes like com.p6spy.engine.spy.P6DataSource. The target version 2.10.5.1-tuxcare.3 is NOT AFFECTED because the upstream vendor fix (adding P6DataSource and related classes to the SubTypeValidator blocklist) was already present in version 2.10.5.1 when TuxCare onboarded it. The vulnerable pattern (unblocked P6DataSource deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is a polymorphic typing vulnerability in jackson-databind that allows attackers to execute malicious payloads when Default Typing is enabled by deserializing dangerous gadget classes like com.p6spy.engine.spy.P6DataSource. The target version 2.10.5.1-tuxcare.3 is NOT AFFECTED because the upstream vendor fix (adding P6DataSource and related classes to the SubTypeValidator blocklist) was already present in version 2.10.5.1 when TuxCare onboarded it. The vulnerable pattern (unblocked P6DataSource deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:27:13.005239+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT AFFECTED by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the dangerous gadget class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. The fix (blocklisting this class in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b56d2ddddb77edd895ee756b7f75eb (September 2019) and was already included in the upstream release 2.10.5.1 that TuxCare onboarded. The CVE states the vulnerability exists in versions \"before 2.9.10 and 2.8.11.5\"; the target version 2.10.5.1 is after 2.9.10 and contains the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT AFFECTED by CVE-2019-17267. The vulnerability concerns polymorphic deserialization of the dangerous gadget class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. The fix (blocklisting this class in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b56d2ddddb77edd895ee756b7f75eb (September 2019) and was already included in the upstream release 2.10.5.1 that TuxCare onboarded. The CVE states the vulnerability exists in versions \"before 2.9.10 and 2.8.11.5\"; the target version 2.10.5.1 is after 2.9.10 and contains the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:46:07.417160+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.10.5.1-tuxcare.3. The fix (commit b5a304a985) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.10.5.1 before TuxCare onboarded this version. The fix adds org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java, preventing the polymorphic typing vulnerability that could lead to remote code execution via JNDI lookup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.10.5.1-tuxcare.3. The fix (commit b5a304a985) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.10.5.1 before TuxCare onboarded this version. The fix adds org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource to the deserialization blocklist in SubTypeValidator.java, preventing the polymorphic typing vulnerability that could lead to remote code execution via JNDI lookup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 targets jackson-databind versions lacking blocklist entries for two ehcache JNDI gadget classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector). The target repository jackson-databind 2.10.5.1-tuxcare.3 contains the upstream fix that was shipped in the jackson-databind 2.10.5.1 release. Both gadget classes are present in the deserialization blocklist at SubTypeValidator.java lines 131-132. The fix commit (eb254813cc) by upstream maintainer Tatu Saloranta was part of the 2.10.5.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 targets jackson-databind versions lacking blocklist entries for two ehcache JNDI gadget classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector). The target repository jackson-databind 2.10.5.1-tuxcare.3 contains the upstream fix that was shipped in the jackson-databind 2.10.5.1 release. Both gadget classes are present in the deserialization blocklist at SubTypeValidator.java lines 131-132. The fix commit (eb254813cc) by upstream maintainer Tatu Saloranta was part of the 2.10.5.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:59:33.966848+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind < 2.9.10.4 due to unsafe deserialization of ignite-jta related classes that can lead to arbitrary code execution. The target repository (jackson-databind 2.10.5.1-tuxcare.3) already contains the upstream fix from commit a424c038ba, which adds three JNDI-related gadget class names to the SubTypeValidator blocklist (lines 155-157): CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider. The fix was authored by upstream Jackson maintainer Tatu Saloranta and shipped in the upstream release 2.10.5.1 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind < 2.9.10.4 due to unsafe deserialization of ignite-jta related classes that can lead to arbitrary code execution. The target repository (jackson-databind 2.10.5.1-tuxcare.3) already contains the upstream fix from commit a424c038ba, which adds three JNDI-related gadget class names to the SubTypeValidator blocklist (lines 155-157): CacheJndiTmLookup, CacheJndiTmFactory, and JNDIConnectionProvider. The fix was authored by upstream Jackson maintainer Tatu Saloranta and shipped in the upstream release 2.10.5.1 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.10.5.1-tuxcare.3 is NOT affected by CVE-2020-10672. The vulnerability involves deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to SubTypeValidator's blocklist) was applied by upstream maintainer Tatu Saloranta in commit 592872f4235c7f2a3280725278da55544032f72d and was already present in the upstream jackson-databind 2.10.5.1 release that TuxCare onboarded. The vulnerable code pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target repository jackson-databind 2.10.5.1-tuxcare.3 is NOT affected by CVE-2020-10672. The vulnerability involves deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The fix (adding this class to SubTypeValidator's blocklist) was applied by upstream maintainer Tatu Saloranta in commit 592872f4235c7f2a3280725278da55544032f72d and was already present in the upstream jackson-databind 2.10.5.1 release that TuxCare onboarded. The vulnerable code pattern was never present in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, which allowed deserialization of the dangerous gadget class com.caucho.config.types.ResourceRef. The target version 2.10.5.1 is NOT affected because the upstream fix (commit 1645efbd39 by Tatu Saloranta, dated 2020-03-17) was already included in the upstream release 2.10.5.1 that TuxCare onboarded. The fix adds com.caucho.config.types.ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 164), preventing deserialization of this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, which allowed deserialization of the dangerous gadget class com.caucho.config.types.ResourceRef. The target version 2.10.5.1 is NOT affected because the upstream fix (commit 1645efbd39 by Tatu Saloranta, dated 2020-03-17) was already included in the upstream release 2.10.5.1 that TuxCare onboarded. The fix adds com.caucho.config.types.ResourceRef to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 164), preventing deserialization of this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 concerns jackson-databind's ability to deserialize the org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class, enabling remote code execution. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream jackson-databind 2.10.5.1 release that TuxCare onboarded. The fix commit (08fbfacf89) added RmiProvider class names to the SubTypeValidator blocklist, and this commit is an ancestor of the first TuxCare commit (612dbc8ae3 \"Onboard version 2.10.5.1\"). The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 concerns jackson-databind's ability to deserialize the org.aoju.bus.proxy.provider.remoting.RmiProvider gadget class, enabling remote code execution. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream jackson-databind 2.10.5.1 release that TuxCare onboarded. The fix commit (08fbfacf89) added RmiProvider class names to the SubTypeValidator blocklist, and this commit is an ancestor of the first TuxCare commit (612dbc8ae3 \"Onboard version 2.10.5.1\"). The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target is not affected by CVE-2020-10969. The fix (blocking javax.swing.JEditorPane from polymorphic deserialization) was already present in upstream release 2.10.5.1 when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:147 and is properly integrated into the deserialization pipeline via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target is not affected by CVE-2020-10969. The fix (blocking javax.swing.JEditorPane from polymorphic deserialization) was already present in upstream release 2.10.5.1 when TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:147 and is properly integrated into the deserialization pipeline via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 does not affect jackson-databind 2.10.5.1. The vulnerability relates to deserialization of malicious org.apache.activemq.* gadget classes. The upstream version 2.10.5.1 already contains the complete fix - all 9 activemq classes are blocklisted in SubTypeValidator.java (lines 172-180). This fix was shipped in the upstream release by Tatu Saloranta before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 does not affect jackson-databind 2.10.5.1. The vulnerability relates to deserialization of malicious org.apache.activemq.* gadget classes. The upstream version 2.10.5.1 already contains the complete fix - all 9 activemq classes are blocklisted in SubTypeValidator.java (lines 172-180). This fix was shipped in the upstream release by Tatu Saloranta before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.10.5.1-tuxcare.3) contains the upstream fix that blocks this class from deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit 05d7e0e, 2020-03-25) and was already present in version 2.10.5.1 before TuxCare onboarded it. The vulnerable code path is not present because RmiProvider is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 183), preventing its deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.10.5.1-tuxcare.3) contains the upstream fix that blocks this class from deserialization. The fix was authored by upstream maintainer Tatu Saloranta (commit 05d7e0e, 2020-03-25) and was already present in version 2.10.5.1 before TuxCare onboarded it. The vulnerable code path is not present because RmiProvider is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 183), preventing its deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves jackson-databind's polymorphic deserialization allowing arbitrary code execution via the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The upstream vendor (FasterXML) fixed this in commit e2ba12d5d60715d95105e3e790fc234cfb59893d (March 28, 2020) by adding the class to SubTypeValidator's blocklist. This fix was already included in the upstream 2.10.5.1 release (July-December 2020) that TuxCare onboarded. The target repository contains the fix at SubTypeValidator.java:84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is not present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves jackson-databind's polymorphic deserialization allowing arbitrary code execution via the org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The upstream vendor (FasterXML) fixed this in commit e2ba12d5d60715d95105e3e790fc234cfb59893d (March 28, 2020) by adding the class to SubTypeValidator's blocklist. This fix was already included in the upstream 2.10.5.1 release (July-December 2020) that TuxCare onboarded. The target repository contains the fix at SubTypeValidator.java:84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.10.5.1-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The vulnerability involves deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean that allow arbitrary code execution through polymorphic type handling. The upstream fix (commit 113e89fb08 by Tatu Saloranta, April 6, 2020) added these classes to the SubTypeValidator blacklist, and this fix was already present in the upstream release 2.10.5.1 that TuxCare onboarded (first TuxCare commit 612dbc8ae3 \"Onboard version 2.10.5.1\"). The vulnerable gadget classes are blocked at lines 53-54 of SubTypeValidator.java, and the validation is actively enforced via BeanDeserializerFactory.java line 925.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target jackson-databind 2.10.5.1-tuxcare.3 is NOT AFFECTED by CVE-2020-11619. The vulnerability involves deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean that allow arbitrary code execution through polymorphic type handling. The upstream fix (commit 113e89fb08 by Tatu Saloranta, April 6, 2020) added these classes to the SubTypeValidator blacklist, and this fix was already present in the upstream release 2.10.5.1 that TuxCare onboarded (first TuxCare commit 612dbc8ae3 \"Onboard version 2.10.5.1\"). The vulnerable gadget classes are blocked at lines 53-54 of SubTypeValidator.java, and the validation is actively enforced via BeanDeserializerFactory.java line 925.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerable deserialization gadget class org.apache.commons.jelly.impl.Embedded is already blocked by the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java (line 186). The fix was authored by upstream maintainer Tatu Saloranta in commit 77040d85 and was already present in the upstream release 2.10.5.1 that TuxCare onboarded, 503 commits before TuxCare's first commit (612dbc8a \"Onboard version 2.10.5.1\"). The validateSubType() method enforces this blocklist at runtime, throwing JsonMappingException when the dangerous class is encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerable deserialization gadget class org.apache.commons.jelly.impl.Embedded is already blocked by the DEFAULT_NO_DESER_CLASS_NAMES denylist in SubTypeValidator.java (line 186). The fix was authored by upstream maintainer Tatu Saloranta in commit 77040d85 and was already present in the upstream release 2.10.5.1 that TuxCare onboarded, 503 commits before TuxCare's first commit (612dbc8a \"Onboard version 2.10.5.1\"). The validateSubType() method enforces this blocklist at runtime, throwing JsonMappingException when the dangerous class is encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2020-14060. The vulnerability involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix blocking this gadget class was already present in the upstream release 2.10.5.1 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:189, added by upstream commit d1c67a039 (Tatu Saloranta, April 2020). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "The target jackson-databind version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2020-14060. The vulnerability involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix blocking this gadget class was already present in the upstream release 2.10.5.1 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:189, added by upstream commit d1c67a039 (Tatu Saloranta, April 2020). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2020-14061. This vulnerability involves Jackson's polymorphic deserialization of Oracle JMS gadget classes (oracle.jms.AQjms*) that can lead to arbitrary code execution when malicious JSON payloads specify these classes via type information. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta, April 24, 2020) added all five Oracle JMS class names to the SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was included in the upstream jackson-databind 2.10.5.1 release, which TuxCare subsequently onboarded via commit 612dbc8ae3. The blocklist entries are present at SubTypeValidator.java:194-198 and enforced during polymorphic type validation at line 234. Since the fix was authored by the upstream maintainer (not TuxCare/CloudLinux) and shipped in the upstream release prior to TuxCare's onboarding, this qualifies as an upstream fix with verdict not_affected and justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "The target repository jackson-databind version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2020-14061. This vulnerability involves Jackson's polymorphic deserialization of Oracle JMS gadget classes (oracle.jms.AQjms*) that can lead to arbitrary code execution when malicious JSON payloads specify these classes via type information. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta, April 24, 2020) added all five Oracle JMS class names to the SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was included in the upstream jackson-databind 2.10.5.1 release, which TuxCare subsequently onboarded via commit 612dbc8ae3. The blocklist entries are present at SubTypeValidator.java:194-198 and enforced during polymorphic type validation at line 234. Since the fix was authored by the upstream maintainer (not TuxCare/CloudLinux) and shipped in the upstream release prior to TuxCare's onboarding, this qualifies as an upstream fix with verdict not_affected and justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.10.5.1 is not affected by CVE-2020-14062. The dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is already blacklisted in SubTypeValidator.java (line 119), preventing polymorphic deserialization attacks. This fix was present in the upstream 2.10.5.1 release that TuxCare onboarded, authored by FasterXML maintainer Tatu Saloranta in commit 840eae2ca8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "Target version 2.10.5.1 is not affected by CVE-2020-14062. The dangerous gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is already blacklisted in SubTypeValidator.java (line 119), preventing polymorphic deserialization attacks. This fix was present in the upstream 2.10.5.1 release that TuxCare onboarded, authored by FasterXML maintainer Tatu Saloranta in commit 840eae2ca8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to unsafe deserialization of org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (version 2.10.5.1-tuxcare.3) contains the upstream fix that blocks this class in SubTypeValidator.java line 201. The fix (commit f6d9c664f6) was authored by upstream maintainer Tatu Saloranta and shipped in the 2.10.5.1 release before TuxCare onboarded it. The blocklist defense is actively enforced in BeanDeserializerFactory during deserialization, preventing instantiation of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5 due to unsafe deserialization of org.jsecurity.realm.jndi.JndiRealmFactory. The target repository (version 2.10.5.1-tuxcare.3) contains the upstream fix that blocks this class in SubTypeValidator.java line 201. The fix (commit f6d9c664f6) was authored by upstream maintainer Tatu Saloranta and shipped in the 2.10.5.1 release before TuxCare onboarded it. The blocklist defense is actively enforced in BeanDeserializerFactory during deserialization, preventing instantiation of the dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:47.001354+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 addresses a Jackson polymorphic deserialization gadget vulnerability involving br.com.anteros.dbcp.AnterosDBCPDataSource. The target version 2.10.5.1-tuxcare.3 is NOT AFFECTED because the upstream fix was already present in version 2.10.5.1 when TuxCare onboarded it. The fix adds AnterosDBCPDataSource to SubTypeValidator's blocklist (line 144), preventing instantiation of this gadget class during polymorphic deserialization. The fix commit (3d97153944) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release, predating any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 addresses a Jackson polymorphic deserialization gadget vulnerability involving br.com.anteros.dbcp.AnterosDBCPDataSource. The target version 2.10.5.1-tuxcare.3 is NOT AFFECTED because the upstream fix was already present in version 2.10.5.1 when TuxCare onboarded it. The fix adds AnterosDBCPDataSource to SubTypeValidator's blocklist (line 144), preventing instantiation of this gadget class during polymorphic deserialization. The fix commit (3d97153944) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release, predating any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:46.829367+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 addresses a deserialization gadget vulnerability in jackson-databind related to com.pastdev.httpcomponents.configuration.JndiConfiguration. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT affected because the fix was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The blacklist entry preventing deserialization of JndiConfiguration exists at SubTypeValidator.java:204, added by upstream commit 6cc9f1a1af323cd156f5668a47e43bab324ae16f (authored by Tatu Saloranta on 2020-07-20), which predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 addresses a deserialization gadget vulnerability in jackson-databind related to com.pastdev.httpcomponents.configuration.JndiConfiguration. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT affected because the fix was already present in the upstream release 2.10.5.1 that TuxCare onboarded. The blacklist entry preventing deserialization of JndiConfiguration exists at SubTypeValidator.java:204, added by upstream commit 6cc9f1a1af323cd156f5668a47e43bab324ae16f (authored by Tatu Saloranta on 2020-07-20), which predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in target version 2.10.5.1-tuxcare.3. The upstream fix (commit 3d932709) was already included in the upstream release v2.10.5.1 before TuxCare onboarded it. The fix configures the XML DocumentBuilderFactory to disallow DOCTYPE declarations and disable external DTD loading, preventing XML external entity attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind DOMDeserializer) is NOT present in target version 2.10.5.1-tuxcare.3. The upstream fix (commit 3d932709) was already included in the upstream release v2.10.5.1 before TuxCare onboarded it. The fix configures the XML DocumentBuilderFactory to disallow DOCTYPE declarations and disable external DTD loading, preventing XML external entity attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:05:32.006358+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T09:10:33.056266+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T09:10:50.766711+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T06:14:00.032168+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:05:51.094715+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:05:32.006358+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "action_statement": "Vulnerability CVE-2020-36184 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T06:14:00.032168+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T09:10:50.766711+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:05:32.006358+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking blocklist entry for org.apache.xbean.propertyeditor.JndiConverter, which enables remote code execution via JNDI injection during polymorphic deserialization. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) already included the fix in version 2.10.5.1 before TuxCare onboarded it. The blocklist entry is present at SubTypeValidator.java:135 and actively blocks deserialization of JndiConverter through the validateSubType mechanism in BeanDeserializerFactory. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking blocklist entry for org.apache.xbean.propertyeditor.JndiConverter, which enables remote code execution via JNDI injection during polymorphic deserialization. The target repository (jackson-databind 2.10.5.1-tuxcare.3) is NOT AFFECTED because the upstream vendor (FasterXML) already included the fix in version 2.10.5.1 before TuxCare onboarded it. The blocklist entry is present at SubTypeValidator.java:135 and actively blocks deserialization of JndiConverter through the validateSubType mechanism in BeanDeserializerFactory. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind version 2.10.5.1. The vulnerability concerns deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (Tatu Saloranta) added this class to the SubTypeValidator blocklist in commit 9f4e97019fb (2020-02-29), which was included in upstream release 2.9.10.4. Since version 2.10.5.1 is later than 2.9.10.4, it already contains this fix from the upstream release that TuxCare onboarded. The blocklist entry at line 138 of SubTypeValidator.java prevents deserialization of this dangerous class, effectively blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind version 2.10.5.1. The vulnerability concerns deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (Tatu Saloranta) added this class to the SubTypeValidator blocklist in commit 9f4e97019fb (2020-02-29), which was included in upstream release 2.9.10.4. Since version 2.10.5.1 is later than 2.9.10.4, it already contains this fix from the upstream release that TuxCare onboarded. The blocklist entry at line 138 of SubTypeValidator.java prevents deserialization of this dangerous class, effectively blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:37:53.137465+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves deserialization gadgets where jackson-databind could be exploited via polymorphic type handling to instantiate dangerous classes like com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream fix adds this class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.10.5.1 (committed by Tatu Saloranta in 9f4e97019fb0dd836533d0b6198c88787e235ae2) before TuxCare onboarded the version. The blocklist entry exists at SubTypeValidator.java:141, preventing instantiation of the gadget class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves deserialization gadgets where jackson-databind could be exploited via polymorphic type handling to instantiate dangerous classes like com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream fix adds this class to a deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream release 2.10.5.1 (committed by Tatu Saloranta in 9f4e97019fb0dd836533d0b6198c88787e235ae2) before TuxCare onboarded the version. The blocklist entry exists at SubTypeValidator.java:141, preventing instantiation of the gadget class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT PRESENT in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability relates to deserialization gadgets allowing polymorphic type handling to instantiate the dangerous class br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 9f4e97019fb0, Feb 2020) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream 2.10.5.1 release (Dec 2020) that TuxCare onboarded, so the target version shipped with the fix from day one.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is NOT PRESENT in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability relates to deserialization gadgets allowing polymorphic type handling to instantiate the dangerous class br.com.anteros.dbcp.AnterosDBCPConfig. The upstream fix (commit 9f4e97019fb0, Feb 2020) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream 2.10.5.1 release (Dec 2020) that TuxCare onboarded, so the target version shipped with the fix from day one.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:10.548488+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves deserialization of dangerous gadget classes (javax.swing.JTextPane and others) that enable arbitrary code execution. The fix, which adds these classes to SubTypeValidator's denylist, was already present in upstream version 2.10.5.1 when TuxCare onboarded it. All blocked classes from both upstream patches (commits 7dbf51bf and 08fbfacf) are present in the target's SubTypeValidator.java. The fix commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release, not added by TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.10.5.1-tuxcare.3. The vulnerability involves deserialization of dangerous gadget classes (javax.swing.JTextPane and others) that enable arbitrary code execution. The fix, which adds these classes to SubTypeValidator's denylist, was already present in upstream version 2.10.5.1 when TuxCare onboarded it. All blocked classes from both upstream patches (commits 7dbf51bf and 08fbfacf) are present in the target's SubTypeValidator.java. The fix commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release, not added by TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:18:00.108571+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:18:00.108571+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T13:46:08.489722+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T02:25:57.000889+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2026-54517. The vulnerability was introduced in jackson-databind version 2.20.0 (commit e40aaee8f1, August 2025) when SetterlessProperty.isMerging() was added and made to return true, routing setterless properties through the property-based deserialization buffering path that lacked @JsonView checking. The target version 2.10.5.1 predates this c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.10.5.1-tuxcare.3 is NOT affected by CVE-2026-54517. The vulnerability was introduced in jackson-databind version 2.20.0 (commit e40aaee8f1, August 2025) when SetterlessProperty.isMerging() was added and made to return true, routing setterless properties through the property-based deserialization buffering path that lacked @JsonView checking. The target version 2.10.5.1 predates this c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:57:00.119233+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.10.5.1-tuxcare.3 is not affected by CVE-2026-54518. The vulnerability exists in the `processUnwrappedCreatorProperties()` method of `UnwrappedPropertyHandler`, which does not exist in this version. The unwrapped creator properties feature (combining @JsonUnwrapped with @JsonCreator) was added in version 2.19.0 via commit 502fe888da. Version 2.10.5.1 explicitly rejects this comb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Target version 2.10.5.1-tuxcare.3 is not affected by CVE-2026-54518. The vulnerability exists in the `processUnwrappedCreatorProperties()` method of `UnwrappedPropertyHandler`, which does not exist in this version. The unwrapped creator properties feature (combining @JsonUnwrapped with @JsonCreator) was added in version 2.19.0 via commit 502fe888da. Version 2.10.5.1 explicitly rejects this comb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:33:00.141045+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.10.5.1 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records (introduced in Java 14+, finalized in Java 16) where @JsonIgnore components remain in the property map during PropertyNamingStrategy rename. This version targets Java 7 and contains no Record support. For regular POJOs/classes in this version, @JsonIgnore properties are removed from the prop...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 Target version 2.10.5.1 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records (introduced in Java 14+, finalized in Java 16) where @JsonIgnore components remain in the property map during PropertyNamingStrategy rename. This version targets Java 7 and contains no Record support. For regular POJOs/classes in this version, @JsonIgnore properties are removed from the prop..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:05:11.413483+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:18:00.108571+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:05:51.094715+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:18:00.108571+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T13:57:00.141136+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.10.5.1-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T15:17:27.545389+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.10.5.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.10.5.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}