{
  "@id": "urn:uuid:968f93b6-d28e-422d-8cbb-c59ed9518c89",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 67,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T09:14:16.386602+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind version 2.11.0. The vulnerability affects versions prior to 2.8.11 and 2.9.4. The target version 2.11.0 already contains the upstream fix via SubTypeValidator.java, which implements a blacklist of dangerous classes including all those mentioned in CVE-2017-15095: com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and c3p0 DataSource classes. This fix was shipped in the upstream release before TuxCare onboarded version 2.11.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind version 2.11.0. The vulnerability affects versions prior to 2.8.11 and 2.9.4. The target version 2.11.0 already contains the upstream fix via SubTypeValidator.java, which implements a blacklist of dangerous classes including all those mentioned in CVE-2017-15095: com.sun.rowset.JdbcRowSetImpl, java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes, and c3p0 DataSource classes. This fix was shipped in the upstream release before TuxCare onboarded version 2.11.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:43:48.993875+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind \u22642.8.10 and 2.9.x \u22642.9.3, allowing RCE via polymorphic deserialization when Spring libraries are present by bypassing the incomplete CVE-2017-7525 blacklist. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the comprehensive fix was already present in the upstream 2.11.0 release that TuxCare onboarded. The fix (commit 2235894210 by upstream maintainer Tatu Saloranta) introduced SubTypeValidator with: (1) expanded blacklist including Spring/C3P0/JDK gadget classes, (2) Spring-specific hierarchy checks blocking all org.springframework.* classes inheriting from AbstractPointcutAdvisor or AbstractApplicationContext, and (3) C3P0 DataSource pattern blocking. The defense is active on all deserialization paths via BeanDeserializerFactory._validateSubType (line 141).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind \u22642.8.10 and 2.9.x \u22642.9.3, allowing RCE via polymorphic deserialization when Spring libraries are present by bypassing the incomplete CVE-2017-7525 blacklist. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the comprehensive fix was already present in the upstream 2.11.0 release that TuxCare onboarded. The fix (commit 2235894210 by upstream maintainer Tatu Saloranta) introduced SubTypeValidator with: (1) expanded blacklist including Spring/C3P0/JDK gadget classes, (2) Spring-specific hierarchy checks blocking all org.springframework.* classes inheriting from AbstractPointcutAdvisor or AbstractApplicationContext, and (3) C3P0 DataSource pattern blocking. The defense is active on all deserialization paths via BeanDeserializerFactory._validateSubType (line 141).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:26:58.411173+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability (unsafe deserialization allowing code execution via polymorphic type handling) was fixed in the upstream 2.11.0 release before TuxCare onboarded it. The fix is implemented via SubTypeValidator class which validates and blocks deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.). Fix author: upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability (unsafe deserialization allowing code execution via polymorphic type handling) was fixed in the upstream 2.11.0 release before TuxCare onboarded it. The fix is implemented via SubTypeValidator class which validates and blocks deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, etc.). Fix author: upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:11.201920+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 (Jackson default typing with iBatis XPathParser gadget allowing data exfiltration) is not present in jackson-databind 2.11.0-tuxcare.2. The fix adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 (Jackson default typing with iBatis XPathParser gadget allowing data exfiltration) is not present in jackson-databind 2.11.0-tuxcare.2. The fix adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The vulnerable pattern (missing blacklist entry) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:18:37.716688+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.0-tuxcare.3 is not affected by CVE-2018-12022. The vulnerability pattern has been removed by upstream fixes that were already present in jackson-databind 2.11.0 when TuxCare onboarded it. The fix (blocklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java lines 67-72) was authored by upstream maintainer Tatu Saloranta in commits 28badf7ef60 and 7487cf7eb14, which predate TuxCare's first commit (25b74bf37a \"Onboard version 2.11.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "The target jackson-databind 2.11.0-tuxcare.3 is not affected by CVE-2018-12022. The vulnerability pattern has been removed by upstream fixes that were already present in jackson-databind 2.11.0 when TuxCare onboarded it. The fix (blocklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java lines 67-72) was authored by upstream maintainer Tatu Saloranta in commits 28badf7ef60 and 7487cf7eb14, which predate TuxCare's first commit (25b74bf37a \"Onboard version 2.11.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:19:28.543087+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger JNDI/LDAP lookups leading to remote code execution when Default Typing is enabled. The fix adds these classes to SubTypeValidator's blocklist. This fix was included in the upstream 2.11.0 release (commit 28badf7ef6, June 2018) before TuxCare onboarded the version, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that can trigger JNDI/LDAP lookups leading to remote code execution when Default Typing is enabled. The fix adds these classes to SubTypeValidator's blocklist. This fix was included in the upstream 2.11.0 release (commit 28badf7ef6, June 2018) before TuxCare onboarded the version, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.0-tuxcare.3 is NOT vulnerable to CVE-2018-14718. The fix that blocks org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The blacklist entry exists in SubTypeValidator.java:75 and is enforced via BeanDeserializerFactory._validateSubType() before any deserialization occurs. Fix author: tatu.saloranta@iki.fi (upstream maintainer). Fix commit 87d29af25e is an ancestor of the first TuxCare commit 25b74bf37a, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target version 2.11.0-tuxcare.3 is NOT vulnerable to CVE-2018-14718. The fix that blocks org.slf4j.ext.EventData from polymorphic deserialization was already present in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The blacklist entry exists in SubTypeValidator.java:75 and is enforced via BeanDeserializerFactory._validateSubType() before any deserialization occurs. Fix author: tatu.saloranta@iki.fi (upstream maintainer). Fix commit 87d29af25e is an ancestor of the first TuxCare commit 25b74bf37a, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:59:41.286358+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous classes from blaze-ds and other libraries. The upstream fix (commit 87d29af25e by tatu.saloranta@iki.fi) was shipped in the upstream 2.11.0 release that TuxCare onboarded. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocklisted in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous classes from blaze-ds and other libraries. The upstream fix (commit 87d29af25e by tatu.saloranta@iki.fi) was shipped in the upstream 2.11.0 release that TuxCare onboarded. The four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocklisted in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:07:32.765766+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.0-tuxcare.3) is NOT affected by CVE-2018-14720. The vulnerability was fixed in the upstream release 2.9.7 (August 2018) and the fix was already present in upstream 2.11.0 before TuxCare onboarded it. The 4 dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blacklisted in SubTypeValidator.java and polymorphic deserialization attempts of these classes are blocked at lines 219-253.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target repository (jackson-databind 2.11.0-tuxcare.3) is NOT affected by CVE-2018-14720. The vulnerability was fixed in the upstream release 2.9.7 (August 2018) and the fix was already present in upstream 2.11.0 before TuxCare onboarded it. The 4 dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blacklisted in SubTypeValidator.java and polymorphic deserialization attempts of these classes are blocked at lines 219-253.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:26.936701+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is not present in jackson-databind 2.11.0-tuxcare.3. The fix blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in the upstream 2.11.0 release that TuxCare onboarded. The vulnerable class is present in the blocklist at SubTypeValidator.java:78, preventing SSRF attacks via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is not present in jackson-databind 2.11.0-tuxcare.3. The fix blocking org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization was already included in the upstream 2.11.0 release that TuxCare onboarded. The vulnerable class is present in the blocklist at SubTypeValidator.java:78, preventing SSRF attacks via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:47:30.687322+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.0-tuxcare.2) is NOT affected by CVE-2018-19360. The vulnerability involves polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo, which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a229fb28ec133235003dd4616f70afaa (issue #2186) by adding the dangerous class to the SubTypeValidator blocklist. This fix was already present in the upstream 2.11.0 release that TuxCare onboarded, predating any TuxCare modifications. The SubTypeValidator.java file at lines 80-85 contains the blocklist entry, and the validateSubType method (lines 219-220) actively enforces the blocklist by throwing JsonMappingException when blocked classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "The target repository (jackson-databind 2.11.0-tuxcare.2) is NOT affected by CVE-2018-19360. The vulnerability involves polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo, which could lead to arbitrary code execution. The upstream vendor (FasterXML) fixed this vulnerability in commit 72cd4025a229fb28ec133235003dd4616f70afaa (issue #2186) by adding the dangerous class to the SubTypeValidator blocklist. This fix was already present in the upstream 2.11.0 release that TuxCare onboarded, predating any TuxCare modifications. The SubTypeValidator.java file at lines 80-85 contains the blocklist entry, and the validateSubType method (lines 219-220) actively enforces the blocklist by throwing JsonMappingException when blocked classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:55:41.476005+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 via polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime). The target version 2.11.0-tuxcare.3 is not affected because the upstream fix was already present in the base version 2.11.0 that TuxCare onboarded. The SubTypeValidator.java file contains the openjpa classes in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 82-83), and the validation logic prevents their deserialization. Fix commits 72cd4025a2 and 42912cac47 authored by upstream maintainer Tatu Saloranta are present in the repository's history, predating the first TuxCare commit (25b74bf37a \"Onboard version 2.11.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 via polymorphic deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime). The target version 2.11.0-tuxcare.3 is not affected because the upstream fix was already present in the base version 2.11.0 that TuxCare onboarded. The SubTypeValidator.java file contains the openjpa classes in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 82-83), and the validation logic prevents their deserialization. Fix commits 72cd4025a2 and 42912cac47 authored by upstream maintainer Tatu Saloranta are present in the repository's history, predating the first TuxCare commit (25b74bf37a \"Onboard version 2.11.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:24:24.833839+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability affects polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, dated 2018-11-19) was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded on 2026-09-20. The fix adds DocumentEditor to the SubTypeValidator blocklist at line 81, preventing its instantiation during deserialization. The validator is actively enforced through BeanDeserializerFactory._validateSubType() at line 925.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability affects polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, dated 2018-11-19) was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded on 2026-09-20. The fix adds DocumentEditor to the SubTypeValidator blocklist at line 81, preventing its instantiation during deserialization. The validator is actively enforced through BeanDeserializerFactory._validateSubType() at line 925.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability exploits two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The fix for these gadgets was already included in upstream release 2.11.0, which TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 62-63) and are actively blocked during deserialization by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability exploits two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The fix for these gadgets was already included in upstream release 2.11.0, which TuxCare onboarded. Both gadget classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 62-63) and are actively blocked during deserialization by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:27.906732+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.0-tuxcare.3 is not affected by CVE-2018-7489. The fix blocking deserialization of c3p0 DataSource classes (PREFIX_C3P0 check with endsWith(\"DataSource\") validation in SubTypeValidator.java lines 238-248) was already present in the upstream release 2.11.0 that TuxCare onboarded. The fix was authored by the upstream vendor (Tatu Saloranta) and applied via commit 6799f8f10c before the first TuxCare commit 25b74bf37a9. The vulnerable pattern is absent because the upstream release shipped with the protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "Target version 2.11.0-tuxcare.3 is not affected by CVE-2018-7489. The fix blocking deserialization of c3p0 DataSource classes (PREFIX_C3P0 check with endsWith(\"DataSource\") validation in SubTypeValidator.java lines 238-248) was already present in the upstream release 2.11.0 that TuxCare onboarded. The fix was authored by the upstream vendor (Tatu Saloranta) and applied via commit 6799f8f10c before the first TuxCare commit 25b74bf37a9. The vulnerable pattern is absent because the upstream release shipped with the protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:32:27.596761+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9, allowing arbitrary file read via polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin. The target version 2.11.0-tuxcare.3 is NOT vulnerable because the upstream vendor (FasterXML) fixed this in the 2.11.0 release by adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.11.0, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9, allowing arbitrary file read via polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin. The target version 2.11.0-tuxcare.3 is NOT vulnerable because the upstream vendor (FasterXML) fixed this in the 2.11.0 release by adding MiniAdmin to the deserialization blocklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.11.0, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:32:00.220852+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource, allowing polymorphic deserialization attacks. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in upstream release 2.11.0. The blocklist entry was added by upstream maintainer Tatu Saloranta in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource, allowing polymorphic deserialization attacks. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in upstream release 2.11.0. The blocklist entry was added by upstream maintainer Tatu Saloranta in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:15:16.086271+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind through version 2.9.9 when Default Typing is enabled and JDOM is in the classpath, allowing arbitrary file reads via malicious JSON. The target repository (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream jackson-databind 2.11.0 release. The JDOM XSLTransformer classes (org.jdom.transform.XSLTransforme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind through version 2.9.9 when Default Typing is enabled and JDOM is in the classpath, allowing arbitrary file reads via malicious JSON. The target repository (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream jackson-databind 2.11.0 release. The JDOM XSLTransformer classes (org.jdom.transform.XSLTransforme..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:14.959299+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.0 is NOT AFFECTED by CVE-2019-14379. The vulnerable code pattern is not present because the upstream fix (commit ad418eeb97) was already included in the upstream 2.11.0 release before TuxCare onboarded it. The fix adds `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` and `ch.qos.logback.core.db.JNDIConnectionSource` to the deserialization blacklist in SubTypeValidator.java, preventing the remote code execution attack via malicious JSON with default typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "Target version 2.11.0 is NOT AFFECTED by CVE-2019-14379. The vulnerable code pattern is not present because the upstream fix (commit ad418eeb97) was already included in the upstream 2.11.0 release before TuxCare onboarded it. The fix adds `net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup` and `ch.qos.logback.core.db.JNDIConnectionSource` to the deserialization blacklist in SubTypeValidator.java, preventing the remote code execution attack via malicious JSON with default typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:30:30.768655+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous logback classes (ch.qos.logback.core.db.JNDIConnectionSource) that could lead to JNDI injection and remote code execution. The target already contains the upstream fix from commit ad418eeb97 which added the dangerous class to the deserialization blocklist in SubTypeValidator.java. This fix was included in jackson-databind 2.10.0 and was inherited when TuxCare onboarded version 2.11.0. The vulnerable code pattern (ability to instantiate the logback JNDI class via polymorphic typing) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of dangerous logback classes (ch.qos.logback.core.db.JNDIConnectionSource) that could lead to JNDI injection and remote code execution. The target already contains the upstream fix from commit ad418eeb97 which added the dangerous class to the deserialization blocklist in SubTypeValidator.java. This fix was included in jackson-databind 2.10.0 and was inherited when TuxCare onboarded version 2.11.0. The vulnerable code pattern (ability to instantiate the logback JNDI class via polymorphic typing) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:46:51.408476+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.11.0. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which can be exploited as gadget classes. The upstream vendor (Tatu Saloranta) fixed this by adding these classes to the SubTypeValidator blocklist in August-September 2019 (commits d4983c740fe and 73c1c2cc76e). These fixes were included in the upstream jackson-databind 2.11.0 release (April 2020), which TuxCare subsequently onboarded. The target repository at HEAD (SHA 5bbecdd3142e) contains the complete fix at SubTypeValidator.java:105-107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.11.0. The vulnerability relates to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes, which can be exploited as gadget classes. The upstream vendor (Tatu Saloranta) fixed this by adding these classes to the SubTypeValidator blocklist in August-September 2019 (commits d4983c740fe and 73c1c2cc76e). These fixes were included in the upstream jackson-databind 2.11.0 release (April 2020), which TuxCare subsequently onboarded. The target repository at HEAD (SHA 5bbecdd3142e) contains the complete fix at SubTypeValidator.java:105-107.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:54:24.198988+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.11.0-tuxcare.3. The fix was already included in the upstream jackson-databind 2.11.0 release. The target contains the necessary blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration in SubTypeValidator.java (lines 112-114), preventing polymorphic deserialization of these dangerous JNDI classes. This fix was authored by upstream maintainer Tatu Saloranta on 2019-09-19, years before TuxCare onboarded version 2.11.0 on 2026-09-20.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.11.0-tuxcare.3. The fix was already included in the upstream jackson-databind 2.11.0 release. The target contains the necessary blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration in SubTypeValidator.java (lines 112-114), preventing polymorphic deserialization of these dangerous JNDI classes. This fix was authored by upstream maintainer Tatu Saloranta on 2019-09-19, years before TuxCare onboarded version 2.11.0 on 2026-09-20.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to remote code execution. The fix (adding this class to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta on 2019-09-19 and shipped in upstream release 2.11.0 (2020-04-25). TuxCare onboarded version 2.11.0 which already contained this fix. The target is not affected because the vulnerable pattern is not present - the dangerous class is blocked at SubTypeValidator.java:117.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) leading to remote code execution. The fix (adding this class to the deserialization blocklist) was authored by upstream maintainer Tatu Saloranta on 2019-09-19 and shipped in upstream release 2.11.0 (2020-04-25). TuxCare onboarded version 2.11.0 which already contained this fix. The target is not affected because the vulnerable pattern is not present - the dangerous class is blocked at SubTypeValidator.java:117.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:04:40.164782+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in upstream release 2.11.0. The fix (commit 73c1c2cc76, authored by upstream maintainer tatu.saloranta@iki.fi on 2019-09-12) added HikariDataSource to the deny list in SubTypeValidator.java:107 before TuxCare onboarded version 2.11.0 on 2026-09-20. The vulnerable pattern is absent from the target - the class is blocked from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic deserialization of com.zaxxer.hikari.HikariDataSource. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in upstream release 2.11.0. The fix (commit 73c1c2cc76, authored by upstream maintainer tatu.saloranta@iki.fi on 2019-09-12) added HikariDataSource to the deny list in SubTypeValidator.java:107 before TuxCare onboarded version 2.11.0 on 2026-09-20. The vulnerable pattern is absent from the target - the class is blocked from polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:04:18.596746+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind's polymorphic typing feature when commons-dbcp classes can be deserialized to achieve RCE. The target repository (jackson-databind 2.11.0-tuxcare.3) contains the upstream fix that was already included in the 2.11.0 release (April 2020). The fix adds org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource to the SubTypeValidator blocklist (lines 120-122), preventing their instantiation during polymorphic deserialization. Fix commits 9593e16cf5 and 328a0f833d (September 2019, authored by tatu.saloranta@iki.fi) are ancestors of the first TuxCare commit 25b74bf37a (onboarding of 2.11.0). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind's polymorphic typing feature when commons-dbcp classes can be deserialized to achieve RCE. The target repository (jackson-databind 2.11.0-tuxcare.3) contains the upstream fix that was already included in the 2.11.0 release (April 2020). The fix adds org.apache.commons.dbcp.datasources.PerUserPoolDataSource, org.apache.commons.dbcp.datasources.SharedPoolDataSource, and com.p6spy.engine.spy.P6DataSource to the SubTypeValidator blocklist (lines 120-122), preventing their instantiation during polymorphic deserialization. Fix commits 9593e16cf5 and 328a0f833d (September 2019, authored by tatu.saloranta@iki.fi) are ancestors of the first TuxCare commit 25b74bf37a (onboarding of 2.11.0). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:14:22.639496+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.0-tuxcare.3 is NOT affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization gadgets using p6spy and commons-dbcp DataSource classes. The fix (blocklisting these dangerous classes in SubTypeValidator) was already present in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "The target jackson-databind 2.11.0-tuxcare.3 is NOT affected by CVE-2019-16943. The vulnerability involves polymorphic deserialization gadgets using p6spy and commons-dbcp DataSource classes. The fix (blocklisting these dangerous classes in SubTypeValidator) was already present in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not affecting this target. The vulnerability relates to jackson-databind's polymorphic deserialization allowing instantiation of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87 by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java and was already included in the upstream jackson-databind 2.11.0 release. The target repository (version 2.11.0-tuxcare.3) contains this upstream fix at line 99 of SubTypeValidator.java, preventing the vulnerable deserialization pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is not affecting this target. The vulnerability relates to jackson-databind's polymorphic deserialization allowing instantiation of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87 by Tatu Saloranta) added this class to the deserialization blacklist in SubTypeValidator.java and was already included in the upstream jackson-databind 2.11.0 release. The target repository (version 2.11.0-tuxcare.3) contains this upstream fix at line 99 of SubTypeValidator.java, preventing the vulnerable deserialization pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:47:28.358565+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability allowed arbitrary code execution via JNDI lookup when deserializing apache-log4j-extra classes with Default Typing enabled. The fix (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) was already included in the upstream jackson-databind 2.11.0 release (commit b5a304a985 by tatu.saloranta@iki.fi, 2019-10-12) before TuxCare onboarded version 2.11.0. The target has the complete blocklist in SubTypeValidator.java lines 124-126, and the validation is active in the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability allowed arbitrary code execution via JNDI lookup when deserializing apache-log4j-extra classes with Default Typing enabled. The fix (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) was already included in the upstream jackson-databind 2.11.0 release (commit b5a304a985 by tatu.saloranta@iki.fi, 2019-10-12) before TuxCare onboarded version 2.11.0. The target has the complete blocklist in SubTypeValidator.java lines 124-126, and the validation is active in the deserialization flow via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability required blocking two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) to prevent JNDI injection attacks via polymorphic deserialization. These blocklist entries are present in SubTypeValidator.java:129-130. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and included in upstream release 2.11.0, which TuxCare then onboarded. Per fixing-commit attribution rules, this is an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.11.0-tuxcare.3. The vulnerability required blocking two ehcache classes (net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector) to prevent JNDI injection attacks via polymorphic deserialization. These blocklist entries are present in SubTypeValidator.java:129-130. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and included in upstream release 2.11.0, which TuxCare then onboarded. Per fixing-commit attribution rules, this is an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:32.199516+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.11.0 that TuxCare onboarded. The three dangerous classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) are blocked in SubTypeValidator.java lines 149-152. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the base 2.11.0 release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta classes. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release 2.11.0 that TuxCare onboarded. The three dangerous classes (CacheJndiTmLookup, CacheJndiTmFactory, JNDIConnectionProvider) are blocked in SubTypeValidator.java lines 149-152. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the base 2.11.0 release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory). The target repository (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the jackson-databind 2.11.0 release that TuxCare onboarded. The blocklist entries preventing deserialization of the vulnerable classes are present in SubTypeValidator.java at lines 155-156, matching the upstream patch exactly. The fix commit (592872f4235c7f2a3280725278da55544032f72d) was authored by upstream maintainer Tatu Saloranta on March 15, 2020, and was included in the upstream 2.11.0 release (April 25, 2020) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory). The target repository (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the jackson-databind 2.11.0 release that TuxCare onboarded. The blocklist entries preventing deserialization of the vulnerable classes are present in SubTypeValidator.java at lines 155-156, matching the upstream patch exactly. The fix commit (592872f4235c7f2a3280725278da55544032f72d) was authored by upstream maintainer Tatu Saloranta on March 15, 2020, and was included in the upstream 2.11.0 release (April 25, 2020) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4/2.6.7.4 due to a deserialization gadget involving com.caucho.config.types.ResourceRef. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the 2.11.0 release when TuxCare onboarded it. The blocklist entry for ResourceRef exists at SubTypeValidator.java:159, added by upstream commit 1645efbd39 (authored by Tatu Saloranta on 2020-03-17), which predates TuxCare's onboarding commit 25b74bf37a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4/2.6.7.4 due to a deserialization gadget involving com.caucho.config.types.ResourceRef. The target (jackson-databind 2.11.0-tuxcare.3) is NOT AFFECTED because the upstream fix was already present in the 2.11.0 release when TuxCare onboarded it. The blocklist entry for ResourceRef exists at SubTypeValidator.java:159, added by upstream commit 1645efbd39 (authored by Tatu Saloranta on 2020-03-17), which predates TuxCare's onboarding commit 25b74bf37a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.0-tuxcare.3 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves Jackson's polymorphic deserialization of the dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix (blacklisting these classes in SubTypeValidator) is already present in the target at lines 162-163 of SubTypeValidator.java. This fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 05d7e0e13f) and was already included in the upstream 2.11.0 release before TuxCare onboarded it (first TuxCare commit 25b74bf37a by amoniatovskiy@cloudlinux.com). The CVE affects versions \"2.x before 2.9.10.4\", and this is version 2.11.0, which is after the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target jackson-databind 2.11.0-tuxcare.3 is NOT AFFECTED by CVE-2020-10968. The vulnerability involves Jackson's polymorphic deserialization of the dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix (blacklisting these classes in SubTypeValidator) is already present in the target at lines 162-163 of SubTypeValidator.java. This fix was authored by upstream FasterXML maintainer Tatu Saloranta (commit 05d7e0e13f) and was already included in the upstream 2.11.0 release before TuxCare onboarded it (first TuxCare commit 25b74bf37a by amoniatovskiy@cloudlinux.com). The CVE affects versions \"2.x before 2.9.10.4\", and this is version 2.11.0, which is after the fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.0-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability pattern (unrestricted deserialization of javax.swing.JEditorPane) is not present because the fix was already included in the upstream Jackson 2.11.0 release that TuxCare onboarded. The blocklist entry preventing javax.swing.JEditorPane deserialization exists at SubTypeValidator.java:143.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target version 2.11.0-tuxcare.3 is not affected by CVE-2020-10969. The vulnerability pattern (unrestricted deserialization of javax.swing.JEditorPane) is not present because the fix was already included in the upstream Jackson 2.11.0 release that TuxCare onboarded. The blocklist entry preventing javax.swing.JEditorPane deserialization exists at SubTypeValidator.java:143.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target version 2.11.0 was released on April 25, 2020, already containing the fix that was committed on March 26, 2020 (commit c14c9f99ed). The fix adds org.apache.activemq.* classes to the SubTypeValidator deny-list (DEFAULT_NO_DESER_CLASS_NAMES), preventing deserialization of these gadget classes. All nine activemq-related classes from the patch are present in the target's SubTypeValidator.java (lines 165-175). This is an upstream fix by Tatu Saloranta that shipped in the original 2.11.0 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target version 2.11.0 was released on April 25, 2020, already containing the fix that was committed on March 26, 2020 (commit c14c9f99ed). The fix adds org.apache.activemq.* classes to the SubTypeValidator deny-list (DEFAULT_NO_DESER_CLASS_NAMES), preventing deserialization of these gadget classes. All nine activemq-related classes from the patch are present in the target's SubTypeValidator.java (lines 165-175). This is an upstream fix by Tatu Saloranta that shipped in the original 2.11.0 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112: Target is NOT AFFECTED. The vulnerability pattern is absent because the upstream fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676) was already present in jackson-databind 2.11.0 when TuxCare onboarded this version. The dangerous gadget class 'org.apache.commons.proxy.provider.remoting.RmiProvider' is blocked in SubTypeValidator.java at line 178, preventing deserialization attacks via this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112: Target is NOT AFFECTED. The vulnerability pattern is absent because the upstream fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676) was already present in jackson-databind 2.11.0 when TuxCare onboarded this version. The dangerous gadget class 'org.apache.commons.proxy.provider.remoting.RmiProvider' is blocked in SubTypeValidator.java at line 178, preventing deserialization attacks via this class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of org.apache.openjpa.ee.WASRegistryManagedRuntime, a gadget class that can execute arbitrary code. The fix (adding WASRegistryManagedRuntime to the SubTypeValidator blocklist) was already included in the upstream jackson-databind 2.11.0 release via commit e2ba12d5d6 by Tatu Saloranta on March 28, 2020. When TuxCare onboarded version 2.11.0 (commit 25b74bf37a), this fix was already present, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of org.apache.openjpa.ee.WASRegistryManagedRuntime, a gadget class that can execute arbitrary code. The fix (adding WASRegistryManagedRuntime to the SubTypeValidator blocklist) was already included in the upstream jackson-databind 2.11.0 release via commit e2ba12d5d6 by Tatu Saloranta on March 28, 2020. When TuxCare onboarded version 2.11.0 (commit 25b74bf37a), this fix was already present, so the target has never been vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.11.0-tuxcare.3. The fix (commit 113e89fb08) was already included in the upstream 2.11.0 release, predating TuxCare's onboarding. The SubTypeValidator blocklist contains both org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean at lines 53-54, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.11.0-tuxcare.3. The fix (commit 113e89fb08) was already included in the upstream 2.11.0 release, predating TuxCare's onboarding. The SubTypeValidator blocklist contains both org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean at lines 53-54, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability concerns unsafe deserialization of the org.apache.commons.jelly.impl.Embedded gadget class. The fix was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. Line 181 of SubTypeValidator.java adds the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist, preventing its deserialization. The validateSubType() method (lines 209-254) checks this blacklist during deserialization and throws JsonMappingException before object instantiation occurs, blocking the attack chain from attacker-controlled type metadata to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability concerns unsafe deserialization of the org.apache.commons.jelly.impl.Embedded gadget class. The fix was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. Line 181 of SubTypeValidator.java adds the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blacklist, preventing its deserialization. The validateSubType() method (lines 209-254) checks this blacklist during deserialization and throws JsonMappingException before object instantiation occurs, blocking the attack chain from attacker-controlled type metadata to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 concerns a Jackson deserialization gadget vulnerability involving oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix (adding this class to the SubTypeValidator blacklist) was already present in the upstream 2.11.0 release that TuxCare onboarded. The target repository at version 2.11.0-tuxcare.3 contains the fix at line 184 of SubTypeValidator.java, authored by upstream maintainer Tatu Saloranta in commit d1c67a0396, which predates the first TuxCare commit (onboarding 25b74bf37a). The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 concerns a Jackson deserialization gadget vulnerability involving oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix (adding this class to the SubTypeValidator blacklist) was already present in the upstream 2.11.0 release that TuxCare onboarded. The target repository at version 2.11.0-tuxcare.3 contains the fix at line 184 of SubTypeValidator.java, authored by upstream maintainer Tatu Saloranta in commit d1c67a0396, which predates the first TuxCare commit (onboarding 25b74bf37a). The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves unsafe deserialization of five Oracle JMS connection factory classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) that can lead to arbitrary code execution. The upstream fix (commit 5c8642aeae by Tatu Saloranta) added these classes to the deserialization blocklist in SubTypeValidator.java and was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The target version ships with this protection enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerability involves unsafe deserialization of five Oracle JMS connection factory classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory) that can lead to arbitrary code execution. The upstream fix (commit 5c8642aeae by Tatu Saloranta) added these classes to the deserialization blocklist in SubTypeValidator.java and was already included in the upstream jackson-databind 2.11.0 release that TuxCare onboarded. The target version ships with this protection enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T14:07:58.696687+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "action_statement": "Vulnerability CVE-2020-14062 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T14:07:58.696687+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "action_statement": "Vulnerability CVE-2020-14195 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:48:27.568694+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "action_statement": "Vulnerability CVE-2020-24616 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:48:27.568694+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "action_statement": "Vulnerability CVE-2020-24750 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "action_statement": "Vulnerability CVE-2020-25649 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T09:14:16.386602+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:48:27.568694+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T09:14:16.386602+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T09:14:16.386602+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T14:07:00.096675+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T14:07:00.096675+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:48:27.568694+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "action_statement": "Vulnerability CVE-2020-36184 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T06:15:09.638899+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T09:14:16.386602+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:48:27.568694+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:47:00.088739+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:10:12.627525+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.0-tuxcare.3 is not affected by CVE-2020-8840. The fix adding org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist was already present in the upstream 2.11.0 release before TuxCare onboarded it. The vulnerable pattern (missing blocklist entry that would allow JndiConverter deserialization leading to JNDI injection) is not present in the target. Fix commit 914e7c9f2c authored by upstream maintainer Tatu Saloranta was included in the original 2.11.0 release, 1628 commits before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind 2.11.0-tuxcare.3 is not affected by CVE-2020-8840. The fix adding org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist was already present in the upstream 2.11.0 release before TuxCare onboarded it. The vulnerable pattern (missing blocklist entry that would allow JndiConverter deserialization leading to JNDI injection) is not present in the target. Fix commit 914e7c9f2c authored by upstream maintainer Tatu Saloranta was included in the original 2.11.0 release, 1628 commits before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.11.0. The fix (blocking org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig from deserialization) was already included in the upstream 2.11.0 release via commit 1e64db6a2f by upstream maintainer Tatu Saloranta. The blocklist entry is present at SubTypeValidator.java:136 and is actively enforced in the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.11.0. The fix (blocking org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig from deserialization) was already included in the upstream 2.11.0 release via commit 1e64db6a2f by upstream maintainer Tatu Saloranta. The blocklist entry is present at SubTypeValidator.java:136 and is actively enforced in the deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:39:34.721796+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerable gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is blocked in SubTypeValidator.java. This fix was included in upstream jackson-databind 2.11.0 (commit 9f4e97019f by Tatu Saloranta) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.11.0-tuxcare.3. The vulnerable gadget class com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is blocked in SubTypeValidator.java. This fix was included in upstream jackson-databind 2.11.0 (commit 9f4e97019f by Tatu Saloranta) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository is jackson-databind version 2.11.0-tuxcare.3, which already contains the upstream fix. The fix (commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by tatu.saloranta@iki.fi) added br.com.anteros.dbcp.AnterosDBCPConfig to the SubTypeValidator blocklist and was included in the upstream 2.11.0 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig. The target repository is jackson-databind version 2.11.0-tuxcare.3, which already contains the upstream fix. The fix (commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by tatu.saloranta@iki.fi) added br.com.anteros.dbcp.AnterosDBCPConfig to the SubTypeValidator blocklist and was included in the upstream 2.11.0 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:47:00.088739+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:47:00.088739+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:45:22.388117+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "action_statement": "Vulnerability CVE-2026-54515 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T14:07:58.696687+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:27:08.077232+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.11.0 is NOT affected by CVE-2026-54517. While the missing view check exists in the property-buffering code path (BeanDeserializer.java:449-452), the architectural prerequisite for exploitation does not exist. The CVE requires SetterlessProperty.isMerging() to return true, routing setterless collections through the unguarded buffering path. Version 2.11.0 lacks the isMerging() method e...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.0 is NOT affected by CVE-2026-54517. While the missing view check exists in the property-buffering code path (BeanDeserializer.java:449-452), the architectural prerequisite for exploitation does not exist. The CVE requires SetterlessProperty.isMerging() to return true, routing setterless collections through the unguarded buffering path. Version 2.11.0 lacks the isMerging() method e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:00:46.216689+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.11.0 is not affected by CVE-2026-54518. The vulnerability requires the processUnwrappedCreatorProperties() method which does not exist in this version. The feature (@JsonUnwrapped on creator parameters) was not implemented until version 2.19.0 (commit 502fe888da). Version 2.11.0 explicitly rejects this combination with error \"Cannot define Creator parameter as @JsonUnwrapped: combinat...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.0 is not affected by CVE-2026-54518. The vulnerability requires the processUnwrappedCreatorProperties() method which does not exist in this version. The feature (@JsonUnwrapped on creator parameters) was not implemented until version 2.19.0 (commit 502fe888da). Version 2.11.0 explicitly rejects this combination with error \"Cannot define Creator parameter as @JsonUnwrapped: combinat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:38:32.174942+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.11.0 is NOT affected by CVE-2026-59888. This vulnerability specifically affects Java Records with @JsonIgnore annotations when PropertyNamingStrategy is used. Java Record support was added in jackson-databind 2.12.0 (commit dd2ed05fff), and the target version 2.11.0 predates this feature. The target also targets Java 7 (javac.src/target.version=1.7), while Records ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.11.0 is NOT affected by CVE-2026-59888. This vulnerability specifically affects Java Records with @JsonIgnore annotations when PropertyNamingStrategy is used. Java Record support was added in jackson-databind 2.12.0 (commit dd2ed05fff), and the target version 2.11.0 predates this feature. The target also targets Java 7 (javac.src/target.version=1.7), while Records ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:48:27.568694+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:45:22.388117+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:45:22.388117+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:45:22.388117+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T14:04:00.238977+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.11.0-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T16:48:00.068690+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.11.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.11.0-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}