{
  "@id": "urn:uuid:35fae5f7-64d5-4f6d-bc55-c8b250a451d3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T08:46:00.063715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4, allowing code execution via deserialization of malicious classes. The target repository is jackson-databind version 2.11.3-tuxcare.4, which already contains the upstream vendor's fix. The fix (commit ddfddfba64 by Tatu Saloranta, dated Aug 17, 2017) adds blacklist entries for dangerous classes (FileHandler, UnicastRemoteObject, JdbcRowSetImpl, PropertyPathFactoryBean, etc.) in SubTypeValidator.java. This fix was present in the upstream release 2.11.3 (Oct 1, 2020) that TuxCare onboarded on Sept 15, 2026. The validateSubType() method enforces this blacklist during deserialization, preventing instantiation of attacker-specified dangerous classes. The vulnerable code pattern is not present because the upstream vendor removed it before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4, allowing code execution via deserialization of malicious classes. The target repository is jackson-databind version 2.11.3-tuxcare.4, which already contains the upstream vendor's fix. The fix (commit ddfddfba64 by Tatu Saloranta, dated Aug 17, 2017) adds blacklist entries for dangerous classes (FileHandler, UnicastRemoteObject, JdbcRowSetImpl, PropertyPathFactoryBean, etc.) in SubTypeValidator.java. This fix was present in the upstream release 2.11.3 (Oct 1, 2020) that TuxCare onboarded on Sept 15, 2026. The validateSubType() method enforces this blacklist during deserialization, preventing instantiation of attacker-specified dangerous classes. The vulnerable code pattern is not present because the upstream vendor removed it before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability concerned an incomplete blacklist for dangerous deserialization types (databind#1737, #1855), specifically affecting Spring framework classes like AbstractPointcutAdvisor and AbstractApplicationContext. The complete fix was authored by Tatu Saloranta (upstream maintainer) in commits 2235894210 and bb45fb16 (December 2017), and shipped in the upstream jackson-databind 2.11.3 release (October 2020). TuxCare onboarded 2.11.3 in September 2026 with this fix already present. The target contains a fully functional SubTypeValidator with all required blacklist entries and Spring hierarchy validation logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability concerned an incomplete blacklist for dangerous deserialization types (databind#1737, #1855), specifically affecting Spring framework classes like AbstractPointcutAdvisor and AbstractApplicationContext. The complete fix was authored by Tatu Saloranta (upstream maintainer) in commits 2235894210 and bb45fb16 (December 2017), and shipped in the upstream jackson-databind 2.11.3 release (October 2020). TuxCare onboarded 2.11.3 in September 2026 with this fix already present. The target contains a fully functional SubTypeValidator with all required blacklist entries and Spring hierarchy validation logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 (jackson-databind deserialization RCE via dangerous gadget classes like TemplatesImpl) is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix was already included in the upstream jackson-databind 2.11.3 release that TuxCare onboarded. The protection mechanism (SubTypeValidator with blocklist of dangerous classes) is present and actively validates all polymorphic deserialization attempts before deserializer construction, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 (jackson-databind deserialization RCE via dangerous gadget classes like TemplatesImpl) is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix was already included in the upstream jackson-databind 2.11.3 release that TuxCare onboarded. The protection mechanism (SubTypeValidator with blocklist of dangerous classes) is present and actively validates all polymorphic deserialization attempts before deserializer construction, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5. The vulnerability allows data exfiltration via the org.apache.ibatis.parsing.XPathParser gadget class when default typing is enabled. The target (version 2.11.3-tuxcare.4) is NOT affected because the upstream vendor fix (commit 27b4defc27 by Tatu Saloranta) was already included in upstream version 2.11.3 when TuxCare onboarded it. The fix adds \"org.apache.ibatis.parsing.XPathParser\" to the SubTypeValidator blacklist, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5. The vulnerability allows data exfiltration via the org.apache.ibatis.parsing.XPathParser gadget class when default typing is enabled. The target (version 2.11.3-tuxcare.4) is NOT affected because the upstream vendor fix (commit 27b4defc27 by Tatu Saloranta) was already included in upstream version 2.11.3 when TuxCare onboarded it. The fix adds \"org.apache.ibatis.parsing.XPathParser\" to the SubTypeValidator blacklist, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability requires the ability to deserialize specific gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP attacks when Default Typing is enabled. The target contains the upstream fix (commit 28badf7ef6) which blacklists these three classes in SubTypeValidator.java lines 67-72. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream jackson-databind 2.11.3 release that TuxCare onboarded (commit 8bb53521). The defense blocks polymorphic deserialization of these gadget classes before instantiation, preventing the attack chain from INPUT (JSON with gadget type) to GOAL (remote code execution via attacker-controlled resource).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability requires the ability to deserialize specific gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP attacks when Default Typing is enabled. The target contains the upstream fix (commit 28badf7ef6) which blacklists these three classes in SubTypeValidator.java lines 67-72. This fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and was already present in the upstream jackson-databind 2.11.3 release that TuxCare onboarded (commit 8bb53521). The defense blocks polymorphic deserialization of these gadget classes before instantiation, preventing the attack chain from INPUT (JSON with gadget type) to GOAL (remote code execution via attacker-controlled resource).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 by allowing arbitrary code execution via polymorphic deserialization of Oracle JDBC classes when Default Typing is enabled. The target repository is jackson-databind version 2.11.3-tuxcare.4, which is newer than all affected versions. The fix (blacklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) was shipped in the upstream release and is present in SubTypeValidator.java lines 70-72. The target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 by allowing arbitrary code execution via polymorphic deserialization of Oracle JDBC classes when Default Typing is enabled. The target repository is jackson-databind version 2.11.3-tuxcare.4, which is newer than all affected versions. The fix (blacklisting oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) was shipped in the upstream release and is present in SubTypeValidator.java lines 70-72. The target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix blocking org.slf4j.ext.EventData from polymorphic deserialization was already included in the upstream release 2.11.3 that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) does not exist in the target because upstream maintainer Tatu Saloranta added the necessary blocklist entries in commit 87d29af25e before the 2.11.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix blocking org.slf4j.ext.EventData from polymorphic deserialization was already included in the upstream release 2.11.3 that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) does not exist in the target because upstream maintainer Tatu Saloranta added the necessary blocklist entries in commit 87d29af25e before the 2.11.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability concerns polymorphic deserialization of dangerous BlazeDS classes (blaze-ds-opt/blaze-ds-core). The fix blocks flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor in SubTypeValidator.java:76. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e and shipped in upstream release 2.11.3 before TuxCare onboarded the version. The vulnerable code pattern is not present in the target because the upstream fix was already included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "Target jackson-databind version 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2018-14719. The vulnerability concerns polymorphic deserialization of dangerous BlazeDS classes (blaze-ds-opt/blaze-ds-core). The fix blocks flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor in SubTypeValidator.java:76. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 87d29af25e and shipped in upstream release 2.11.3 before TuxCare onboarded the version. The vulnerable code pattern is not present in the target because the upstream fix was already included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.3-tuxcare.4 is NOT affected by CVE-2018-14720. The vulnerability requires the ability to instantiate four specific dangerous classes during polymorphic deserialization (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The upstream Jackson project fixed this in commit 87d29af25e by adding these classes to a deserialization blocklist. This fix was already present in upstream release 2.11.3, which TuxCare onboarded. The blocklist is enforced by SubTypeValidator during bean deserialization, throwing \"Illegal type to deserialize: prevented for security reasons\" if any blocked class is encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "Target version 2.11.3-tuxcare.4 is NOT affected by CVE-2018-14720. The vulnerability requires the ability to instantiate four specific dangerous classes during polymorphic deserialization (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl). The upstream Jackson project fixed this in commit 87d29af25e by adding these classes to a deserialization blocklist. This fix was already present in upstream release 2.11.3, which TuxCare onboarded. The blocklist is enforced by SubTypeValidator during bean deserialization, throwing \"Illegal type to deserialize: prevented for security reasons\" if any blocked class is encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability (polymorphic deserialization of axis2-jaxws HandlerResolverImpl class enabling SSRF) was fixed by upstream maintainer Tatu Saloranta in commit 87d29af25e, which added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blocklist. This fix was already present in the upstream 2.11.3 release that TuxCare onboarded. The CVE affects versions before 2.9.7; target version 2.11.3 is well above that boundary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability (polymorphic deserialization of axis2-jaxws HandlerResolverImpl class enabling SSRF) was fixed by upstream maintainer Tatu Saloranta in commit 87d29af25e, which added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the deserialization blocklist. This fix was already present in the upstream 2.11.3 release that TuxCare onboarded. The CVE affects versions before 2.9.7; target version 2.11.3 is well above that boundary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind 2.x before 2.9.8 by allowing polymorphic deserialization of org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.11.3 that TuxCare onboarded. The dangerous class is blocked via denylist entry at SubTypeValidator.java:85. This is an upstream fix by FasterXML (commit 72cd4025a2 by tatu.saloranta@iki.fi, Nov 2018), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind 2.x before 2.9.8 by allowing polymorphic deserialization of org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.11.3 that TuxCare onboarded. The dangerous class is blocked via denylist entry at SubTypeValidator.java:85. This is an upstream fix by FasterXML (commit 72cd4025a2 by tatu.saloranta@iki.fi, Nov 2018), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 that fail to block openjpa classes from polymorphic deserialization. The target is jackson-databind 2.11.3-tuxcare.4, which already includes the upstream fix. The openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are present in the SubTypeValidator.java deny list at lines 82-83, blocking their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 72cd4025a2) and shipped in the upstream 2.11.3 release before TuxCare onboarding (commit 8bb53521cb).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 that fail to block openjpa classes from polymorphic deserialization. The target is jackson-databind 2.11.3-tuxcare.4, which already includes the upstream fix. The openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are present in the SubTypeValidator.java deny list at lines 82-83, blocking their deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 72cd4025a2) and shipped in the upstream 2.11.3 release before TuxCare onboarding (commit 8bb53521cb).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.3-tuxcare.4) is not affected by CVE-2018-19362. The vulnerability, which allows attackers to exploit polymorphic deserialization through the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor), was fixed in upstream jackson-databind 2.9.8. The fix adds dangerous class names to the SubTypeValidator blacklist to prevent their instantiation during polymorphic deserialization. This upstream fix, authored by Tatu Saloranta on 2018-11-19, was already present in jackson-databind 2.11.3 when TuxCare onboarded it. The blacklist entries are visible in SubTypeValidator.java at lines 81-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "The target repository (jackson-databind 2.11.3-tuxcare.4) is not affected by CVE-2018-19362. The vulnerability, which allows attackers to exploit polymorphic deserialization through the jboss-common-core class (org.jboss.util.propertyeditor.DocumentEditor), was fixed in upstream jackson-databind 2.9.8. The fix adds dangerous class names to the SubTypeValidator blacklist to prevent their instantiation during polymorphic deserialization. This upstream fix, authored by Tatu Saloranta on 2018-11-19, was already present in jackson-databind 2.11.3 when TuxCare onboarded it. The blacklist entries are visible in SubTypeValidator.java at lines 81-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability affects versions through 2.8.11 and 2.9.x through 2.9.3, involving two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The upstream vendor (FasterXML) fixed this in commit 038b471e2e (2018-01-21) by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the jackson-databind 2.11.3 release, which TuxCare later onboarded. The blacklist entries are present at lines 62-63 of SubTypeValidator.java, and the validateSubType method enforces this blacklist during deserialization, preventing the gadget classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability affects versions through 2.8.11 and 2.9.x through 2.9.3, involving two deserialization gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The upstream vendor (FasterXML) fixed this in commit 038b471e2e (2018-01-21) by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the jackson-databind 2.11.3 release, which TuxCare later onboarded. The blacklist entries are present at lines 62-63 of SubTypeValidator.java, and the validateSubType method enforces this blacklist during deserialization, preventing the gadget classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.3-tuxcare.4 is not affected by CVE-2018-7489. The upstream fix (commit 6799f8f10cc78e9af6d443ed6982d00a13f2e7d2) was already present in the jackson-databind 2.11.3 release before TuxCare onboarded it. The fix blocks deserialization of c3p0 DataSource classes (including ComboPooledDataSource, JndiRefForwardingDataSource, WrapperConnectionPoolDataSource, and AfterCloseLoggingComboPooledDataSource) by adding pattern-based validation in SubTypeValidator.java that rejects any class whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\". This prevents the unauthenticated remote code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "The target jackson-databind 2.11.3-tuxcare.4 is not affected by CVE-2018-7489. The upstream fix (commit 6799f8f10cc78e9af6d443ed6982d00a13f2e7d2) was already present in the jackson-databind 2.11.3 release before TuxCare onboarded it. The fix blocks deserialization of c3p0 DataSource classes (including ComboPooledDataSource, JndiRefForwardingDataSource, WrapperConnectionPoolDataSource, and AfterCloseLoggingComboPooledDataSource) by adding pattern-based validation in SubTypeValidator.java that rejects any class whose fully-qualified name starts with \"com.mchange.v2.c3p0.\" and ends with \"DataSource\". This prevents the unauthenticated remote code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind 2.x before 2.9.9 due to missing validation of com.mysql.cj.jdbc.admin.MiniAdmin in polymorphic deserialization, allowing arbitrary local file reads. The target version 2.11.3-tuxcare.4 already contains the upstream fix that adds MiniAdmin to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 88). The fix was shipped in upstream version 2.9.9 (May 2019) by FasterXML author Tatu Saloranta and was already present when TuxCare onboarded version 2.11.3. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind 2.x before 2.9.9 due to missing validation of com.mysql.cj.jdbc.admin.MiniAdmin in polymorphic deserialization, allowing arbitrary local file reads. The target version 2.11.3-tuxcare.4 already contains the upstream fix that adds MiniAdmin to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 88). The fix was shipped in upstream version 2.9.9 (May 2019) by FasterXML author Tatu Saloranta and was already present when TuxCare onboarded version 2.11.3. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT affected by CVE-2019-12384. The vulnerability affects jackson-databind versions before 2.9.9.1, and the target is version 2.11.3, which already contains the upstream fix. The fix (blocking ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization) is present at SubTypeValidator.java:91 and was shipped i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT affected by CVE-2019-12384. The vulnerability affects jackson-databind versions before 2.9.9.1, and the target is version 2.11.3, which already contains the upstream fix. The fix (blocking ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization) is present at SubTypeValidator.java:91 and was shipped i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involved JDOM XSLTransformer classes being exploitable as deserialization gadgets to read arbitrary files when Default Typing is enabled. The upstream fix (commit 5f7c69bba0 by tatu.saloranta@iki.fi on 2019-06-13) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserializa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involved JDOM XSLTransformer classes being exploitable as deserialization gadgets to read arbitrary files when Default Typing is enabled. The upstream fix (commit 5f7c69bba0 by tatu.saloranta@iki.fi on 2019-06-13) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserializa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability was fixed in upstream release 2.9.9.2 (July 2019) by adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.11.3, which is a much later upstream release. The target contains the complete fix at lines 98 and 102 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability was fixed in upstream release 2.9.9.2 (July 2019) by adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blocklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.11.3, which is a much later upstream release. The target contains the complete fix at lines 98 and 102 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2/2.8.11.4 when Default Typing is enabled, allowing deserialization of ch.qos.logback.core.db.JNDIConnectionSource for JNDI injection attacks. The target version 2.11.3-tuxcare.4 is NOT affected because the fix was already present in the upstream 2.11.3 release. The dangerous class is blacklisted in SubTypeValidator.java line 102, preventing its deserialization. Fix commit ad418eeb was authored by upstream maintainer Tatu Saloranta on 2019-07-25 and was included in the 2.11.3 release that TuxCare onboarded on 2026-09-15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2/2.8.11.4 when Default Typing is enabled, allowing deserialization of ch.qos.logback.core.db.JNDIConnectionSource for JNDI injection attacks. The target version 2.11.3-tuxcare.4 is NOT affected because the fix was already present in the upstream 2.11.3 release. The dangerous class is blacklisted in SubTypeValidator.java line 102, preventing its deserialization. Fix commit ad418eeb was authored by upstream maintainer Tatu Saloranta on 2019-07-25 and was included in the 2.11.3 release that TuxCare onboarded on 2026-09-15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3, involving polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target repository (jackson-databind 2.11.3-tuxcare.4) already contains the upstream fix that blocks these classes from deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.11.3 release before TuxCare's onboarding. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3, involving polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target repository (jackson-databind 2.11.3-tuxcare.4) already contains the upstream fix that blocks these classes from deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.11.3 release before TuxCare's onboarding. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involved polymorphic deserialization of malicious objects using commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) that could trigger JNDI lookups and enable arbitrary code execution. The fix adds these two class names to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream 2.11.3 release (commit 41b7f9b901 authored by Tatu Saloranta) before TuxCare onboarded the version. The target repository contains the complete fix in SubTypeValidator.java lines 113-114, and the blocklist is actively enforced during deserialization at line 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involved polymorphic deserialization of malicious objects using commons-configuration JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) that could trigger JNDI lookups and enable arbitrary code execution. The fix adds these two class names to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream 2.11.3 release (commit 41b7f9b901 authored by Tatu Saloranta) before TuxCare onboarded the version. The target repository contains the complete fix in SubTypeValidator.java lines 113-114, and the blocklist is actively enforced during deserialization at line 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.11.3 is NOT AFFECTED by CVE-2019-14893. The fix that blocks deserialization of org.apache.xalan.lib.sql.JNDIConnectionPool (the xalan JNDI gadget) is already present in the codebase. This fix was shipped in the upstream release 2.11.3 and was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer. The blacklist entry exists in SubTypeValidator.java at line 117, and the validator is invoked during bean deserialization to prevent instantiation of dangerous classes that could lead to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "The target jackson-databind version 2.11.3 is NOT AFFECTED by CVE-2019-14893. The fix that blocks deserialization of org.apache.xalan.lib.sql.JNDIConnectionPool (the xalan JNDI gadget) is already present in the codebase. This fix was shipped in the upstream release 2.11.3 and was authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer. The blacklist entry exists in SubTypeValidator.java at line 117, and the validator is invoked during bean deserialization to prevent instantiation of dangerous classes that could lead to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10 with a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.11.3 that TuxCare onboarded. The vulnerability allowed attackers to exploit polymorphic deserialization by specifying HikariDataSource as the type in JSON payloads, enabling gadget-chain attacks. The upstream fix (commit 73c1c2cc76 by Tatu Saloranta) added HikariDataSource to the SubTypeValidator deny list, blocking its deserialization. This protection is active in the target at SubTypeValidator.java:107 and is invoked during bean deserialization via BeanDeserializerFactory:924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10 with a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream release 2.11.3 that TuxCare onboarded. The vulnerability allowed attackers to exploit polymorphic deserialization by specifying HikariDataSource as the type in JSON payloads, enabling gadget-chain attacks. The upstream fix (commit 73c1c2cc76 by Tatu Saloranta) added HikariDataSource to the SubTypeValidator deny list, blocking its deserialization. This protection is active in the target at SubTypeValidator.java:107 and is invoked during bean deserialization via BeanDeserializerFactory:924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 affects jackson-databind versions 2.0.0-2.9.10. The target is version 2.11.3-tuxcare.4, which already contains the upstream fix for this vulnerability. The vulnerable code pattern (unblocked commons-dbcp datasource classes that enable RCE via polymorphic deserialization) is not present because the fix commit 9593e16cf5a3d289a9c584f7123639655de9ddac was already included in the upstream 2.11.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 affects jackson-databind versions 2.0.0-2.9.10. The target is version 2.11.3-tuxcare.4, which already contains the upstream fix for this vulnerability. The vulnerable code pattern (unblocked commons-dbcp datasource classes that enable RCE via polymorphic deserialization) is not present because the fix commit 9593e16cf5a3d289a9c584f7123639655de9ddac was already included in the upstream 2.11.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix that adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the deserialization blocklist was already included in the upstream jackson-databind 2.11.3 release. The fix commit (9593e16c) by Tatu Saloranta shipped in the upstream release before TuxCare onboarded version 2.11.3. The target repository contains the defense code in SubTypeValidator.java (lines 121-124) that blocks instantiation of these dangerous classes, preventing the attack chain from Input (type information in JSON) to Goal (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix that adds P6DataSource, SharedPoolDataSource, and PerUserPoolDataSource to the deserialization blocklist was already included in the upstream jackson-databind 2.11.3 release. The fix commit (9593e16c) by Tatu Saloranta shipped in the upstream release before TuxCare onboarded version 2.11.3. The target repository contains the defense code in SubTypeValidator.java (lines 121-124) that blocks instantiation of these dangerous classes, preventing the attack chain from Input (type information in JSON) to Goal (arbitrary code execution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability relates to polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87 by Tatu Saloranta) that adds this class to the SubTypeValidator blocklist was already included in the jackson-databind 2.11.3 upstream release that TuxCare onboarded. The fix is present at line 99 of SubTypeValidator.java, preventing deserialization of this dangerous type.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability relates to polymorphic deserialization of the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87 by Tatu Saloranta) that adds this class to the SubTypeValidator blocklist was already included in the jackson-databind 2.11.3 upstream release that TuxCare onboarded. The fix is present at line 99 of SubTypeValidator.java, preventing deserialization of this dangerous type.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource from deserialization) was already included in the upstream 2.11.3 release that TuxCare onboarded. The blocklist entries are present at lines 127-128 of SubTypeValidator.java and are properly enforced via the validateSubType() method, which throws a security exception when these classes are encountered during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource from deserialization) was already included in the upstream 2.11.3 release that TuxCare onboarded. The blocklist entries are present at lines 127-128 of SubTypeValidator.java and are properly enforced via the validateSubType() method, which throws a security exception when these classes are encountered during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involved missing blocklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could be exploited as deserialization gadgets. The upstream fix (commit eb254813cc by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already included in the upstream jackson-databind 2.11.3 release, which TuxCare subsequently onboarded. The target repository at HEAD (c32861c33f) contains the complete fix at SubTypeValidator.java lines 131-132.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involved missing blocklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could be exploited as deserialization gadgets. The upstream fix (commit eb254813cc by Tatu Saloranta) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. This fix was already included in the upstream jackson-databind 2.11.3 release, which TuxCare subsequently onboarded. The target repository at HEAD (c32861c33f) contains the complete fix at SubTypeValidator.java lines 131-132.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT affected by CVE-2020-10650. This vulnerability involves unsafe deserialization of three dangerous JNDI-related classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider) that enable arbitrary code execution. The upstream fix from commit a424c038ba, which adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream 2.11.3 release that TuxCare onboarded. The SubTypeValidator actively rejects deserialization attempts of these classes with a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT affected by CVE-2020-10650. This vulnerability involves unsafe deserialization of three dangerous JNDI-related classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider) that enable arbitrary code execution. The upstream fix from commit a424c038ba, which adds these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, was already present in the upstream 2.11.3 release that TuxCare onboarded. The SubTypeValidator actively rejects deserialization attempts of these classes with a security error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.11.3-tuxcare.4 is NOT vulnerable to CVE-2020-10672. The fix was already present in the upstream 2.11.3 release that TuxCare onboarded. The vulnerable gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory) are blocked in the SubTypeValidator.java deserialization blocklist at lines 159-161. The fix commit (592872f4235c7f2a3280725278da55544032f72d) was authored by upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already in the upstream 2.11.3 release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "Target jackson-databind 2.11.3-tuxcare.4 is NOT vulnerable to CVE-2020-10672. The fix was already present in the upstream 2.11.3 release that TuxCare onboarded. The vulnerable gadget classes (org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory) are blocked in the SubTypeValidator.java deserialization blocklist at lines 159-161. The fix commit (592872f4235c7f2a3280725278da55544032f72d) was authored by upstream Jackson maintainer Tatu Saloranta (tatu.saloranta@iki.fi) and was already in the upstream 2.11.3 release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involves deserialization of the gadget class com.caucho.config.types.ResourceRef. The fix (blacklisting this class in SubTypeValidator) was implemented by upstream FasterXML in commit 1645efbd39 and shipped in release 2.11.3. TuxCare onboarded this already-fixed version via commit 8bb53521cb by amoniatovskiy@cloudlinux.com. The blacklist entry exists at SubTypeValidator.java:164 and is actively enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involves deserialization of the gadget class com.caucho.config.types.ResourceRef. The fix (blacklisting this class in SubTypeValidator) was implemented by upstream FasterXML in commit 1645efbd39 and shipped in release 2.11.3. TuxCare onboarded this already-fixed version via commit 8bb53521cb by amoniatovskiy@cloudlinux.com. The blacklist entry exists at SubTypeValidator.java:164 and is actively enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2020-10968. The vulnerability's gadget class (org.aoju.bus.proxy.provider.remoting.RmiProvider) is blocked in SubTypeValidator.java lines 166-168. This fix was shipped in the upstream jackson-databind 2.11.3 release (commit 08fbfacf89 by qxo) before TuxCare onboarded the version. The vulnerable deserialization pattern is not present in the target because the upstream vendor's fix was already included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target jackson-databind 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2020-10968. The vulnerability's gadget class (org.aoju.bus.proxy.provider.remoting.RmiProvider) is blocked in SubTypeValidator.java lines 166-168. This fix was shipped in the upstream jackson-databind 2.11.3 release (commit 08fbfacf89 by qxo) before TuxCare onboarded the version. The vulnerable deserialization pattern is not present in the target because the upstream vendor's fix was already included in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. Target version 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2020-10969. The vulnerability (deserialization gadget via javax.swing.JEditorPane) was already fixed in upstream version 2.11.3 before TuxCare onboarded it. The fix commit (6ba48457) by upstream author Tatu Saloranta added javax.swing.JEditorPane to the deserialization blocklist in SubTypeValidator.java, preventing arbitrary code execution via gadget chain exploitation. This fix was shipped in the upstream release and imported during TuxCare's onboarding (commit 8bb53521cb \"Onboard version 2.11.3\"). The vulnerable code pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target version 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2020-10969. The vulnerability (deserialization gadget via javax.swing.JEditorPane) was already fixed in upstream version 2.11.3 before TuxCare onboarded it. The fix commit (6ba48457) by upstream author Tatu Saloranta added javax.swing.JEditorPane to the deserialization blocklist in SubTypeValidator.java, preventing arbitrary code execution via gadget chain exploitation. This fix was shipped in the upstream release and imported during TuxCare's onboarding (commit 8bb53521cb \"Onboard version 2.11.3\"). The vulnerable code pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes that could be exploited through Jackson's polymorphic type handling. The fix (adding these classes to the SubTypeValidator blacklist) was already included in the upstream version 2.11.3 release that TuxCare onboarded. The activemq classes are blacklisted in SubTypeValidator.java lines 170-180, preventing their deserialization. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes that could be exploited through Jackson's polymorphic type handling. The fix (adding these classes to the SubTypeValidator blacklist) was already included in the upstream version 2.11.3 release that TuxCare onboarded. The activemq classes are blacklisted in SubTypeValidator.java lines 170-180, preventing their deserialization. This is an upstream fix by Tatu Saloranta (tatu.saloranta@iki.fi), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is not present in jackson-databind 2.11.3-tuxcare.4. The vendor patch adds org.apache.commons.proxy.provider.remoting.RmiProvider to a deserialization blocklist in SubTypeValidator.java. This blocklist entry is present at line 183 of the target, preventing Jackson from deserializing the dangerous gadget class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.11.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is not present in jackson-databind 2.11.3-tuxcare.4. The vendor patch adds org.apache.commons.proxy.provider.remoting.RmiProvider to a deserialization blocklist in SubTypeValidator.java. This blocklist entry is present at line 183 of the target, preventing Jackson from deserializing the dangerous gadget class. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.11.3 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.3 is not affected by CVE-2020-11113. The vulnerability involves the deserialization gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime, which could allow remote code execution through Jackson's polymorphic deserialization. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.11.3 release before TuxCare onboarded it (first TuxCare commit 8bb53521cb \"Onboard version 2.11.3\"). The fix is confirmed at line 84 of SubTypeValidator.java, and the validation mechanism at line 234 enforces the blocklist by rejecting deserialization attempts with the error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target jackson-databind 2.11.3 is not affected by CVE-2020-11113. The vulnerability involves the deserialization gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime, which could allow remote code execution through Jackson's polymorphic deserialization. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.11.3 release before TuxCare onboarded it (first TuxCare commit 8bb53521cb \"Onboard version 2.11.3\"). The fix is confirmed at line 84 of SubTypeValidator.java, and the validation mechanism at line 234 enforces the blocklist by rejecting deserialization attempts with the error \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.11.3-tuxcare.4. The upstream fix (commit 113e89fb08, issue #2680) that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the SubTypeValidator blocklist was already present in the jackson-databind 2.11.3 upstream release that TuxCare onboarded. The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.11.3-tuxcare.4. The upstream fix (commit 113e89fb08, issue #2680) that adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the SubTypeValidator blocklist was already present in the jackson-databind 2.11.3 upstream release that TuxCare onboarded. The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to deserialization gadget org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.11.3-tuxcare.4) contains the upstream fix that blocks this class from deserialization. The fix (commit 77040d85e3) was authored by upstream maintainer Tatu Saloranta on April 7, 2020 and included in the original jackson-databind 2.11.3 release (October 1, 2020) before TuxCare onboarded the version. The blocklist entry at line 186 of SubTypeValidator.java prevents deserialization of org.apache.commons.jelly.impl.Embedded, and the validation logic actively enforces this block.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to deserialization gadget org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.11.3-tuxcare.4) contains the upstream fix that blocks this class from deserialization. The fix (commit 77040d85e3) was authored by upstream maintainer Tatu Saloranta on April 7, 2020 and included in the original jackson-databind 2.11.3 release (October 1, 2020) before TuxCare onboarded the version. The blocklist entry at line 186 of SubTypeValidator.java prevents deserialization of org.apache.commons.jelly.impl.Embedded, and the validation logic actively enforces this block.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2020-14060. The vulnerability has been fixed by the upstream vendor (FasterXML) in commit d1c67a0 (dated April 24, 2020), which added the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.11.3 release (October 2020) that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (a7a5ae30fc - \"setup 2.11.2\"). The blacklist entry is present at line 189 of SubTypeValidator.java in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "The target repository jackson-databind version 2.11.3-tuxcare.4 is NOT AFFECTED by CVE-2020-14060. The vulnerability has been fixed by the upstream vendor (FasterXML) in commit d1c67a0 (dated April 24, 2020), which added the gadget class `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.11.3 release (October 2020) that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit is an ancestor of the first TuxCare commit (a7a5ae30fc - \"setup 2.11.2\"). The blacklist entry is present at line 189 of SubTypeValidator.java in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involves deserialization of dangerous oracle.jms connection factory classes that could lead to remote code execution. The fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta) was already present in upstream release 2.11.3 (Oct 2020), which added these five oracle.jms classes to the SubTypeValidator blocklist. The target version inherited this fix from the upstream release during onboarding (commit 8bb53521cb), not from a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involves deserialization of dangerous oracle.jms connection factory classes that could lead to remote code execution. The fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta) was already present in upstream release 2.11.3 (Oct 2020), which added these five oracle.jms classes to the SubTypeValidator blocklist. The target version inherited this fix from the upstream release during onboarding (commit 8bb53521cb), not from a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is not present in jackson-databind 2.11.3. The vulnerability affects versions before 2.9.10.5; version 2.11.3 is newer and includes the upstream fix. The malicious class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java:119, preventing JNDI injection attacks via this gadget. The fix was introduced by upstream commit 840eae2ca8 (authored by Tatu Saloranta) and was part of the original 2.11.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is not present in jackson-databind 2.11.3. The vulnerability affects versions before 2.9.10.5; version 2.11.3 is newer and includes the upstream fix. The malicious class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is blocked in SubTypeValidator.java:119, preventing JNDI injection attacks via this gadget. The fix was introduced by upstream commit 840eae2ca8 (authored by Tatu Saloranta) and was part of the original 2.11.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5. The target is version 2.11.3-tuxcare.4, which already contains the upstream fix. The blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory is present in SubTypeValidator.java (line 201), preventing deserialization of this JNDI gadget. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit f6d9c664f6 on June 13, 2020, and was already present in jackson-databind 2.11.3 when TuxCare onboarded that version on September 15, 2026. Therefore, this is not a TuxCare backport but an upstream fix that shipped with the original release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5. The target is version 2.11.3-tuxcare.4, which already contains the upstream fix. The blocklist entry for org.jsecurity.realm.jndi.JndiRealmFactory is present in SubTypeValidator.java (line 201), preventing deserialization of this JNDI gadget. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit f6d9c664f6 on June 13, 2020, and was already present in jackson-databind 2.11.3 when TuxCare onboarded that version on September 15, 2026. Therefore, this is not a TuxCare backport but an upstream fix that shipped with the original release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix blocking br.com.anteros.dbcp.AnterosDBCPDataSource deserialization was shipped by upstream FasterXML in version 2.11.3 (commit 3d97153944, authored by tatu.saloranta@iki.fi). The deny list entry exists in SubTypeValidator.java:144, preventing exploitation of this deserialization gadget. This is an upstream fix that predates TuxCare's onboarding of version 2.11.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix blocking br.com.anteros.dbcp.AnterosDBCPDataSource deserialization was shipped by upstream FasterXML in version 2.11.3 (commit 3d97153944, authored by tatu.saloranta@iki.fi). The deny list entry exists in SubTypeValidator.java:144, preventing exploitation of this deserialization gadget. This is an upstream fix that predates TuxCare's onboarding of version 2.11.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.11.3-tuxcare.4) is not affected by CVE-2020-24750. The vulnerability, which allows arbitrary code execution via deserialization of the JndiConfiguration gadget class, was fixed in the upstream release. The fix adds 'com.pastdev.httpcomponents.configuration.JndiConfiguration' to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its instantiation during polymorphic deserialization. This fix was already present in upstream version 2.11.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "The target repository (jackson-databind 2.11.3-tuxcare.4) is not affected by CVE-2020-24750. The vulnerability, which allows arbitrary code execution via deserialization of the JndiConfiguration gadget class, was fixed in the upstream release. The fix adds 'com.pastdev.httpcomponents.configuration.JndiConfiguration' to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its instantiation during polymorphic deserialization. This fix was already present in upstream version 2.11.3 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix (commit 612f971b78 by Tatu Saloranta) was already included in the upstream release 2.11.3 that TuxCare onboarded. The DOMDeserializer.java file at HEAD contains the required XXE protections: disallow-doctype-decl and load-external-dtd features are properly configured (lines 43-49). This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.11.3-tuxcare.4. The fix (commit 612f971b78 by Tatu Saloranta) was already included in the upstream release 2.11.3 that TuxCare onboarded. The DOMDeserializer.java file at HEAD contains the required XXE protections: disallow-doctype-decl and load-external-dtd features are properly configured (lines 43-49). This is an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T08:46:00.063715+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:28.099615+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T06:15:09.638899+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:52.236213+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:28.099615+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T06:15:09.638899+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:28.099615+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.11.3-tuxcare.4 is NOT affected by CVE-2020-8840. The vulnerability involves JNDI injection via polymorphic deserialization of org.apache.xbean.propertyeditor.JndiConverter. The fix blocking this dangerous class was already present in the upstream jackson-databind 2.11.3 release (commit 914e7c9f by tatu.saloranta@iki.fi, dated 2020-02-09). The blocklist entry exists at SubTypeValidator.java:135 and is actively enforced during deserialization, preventing the exploit described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind 2.11.3-tuxcare.4 is NOT affected by CVE-2020-8840. The vulnerability involves JNDI injection via polymorphic deserialization of org.apache.xbean.propertyeditor.JndiConverter. The fix blocking this dangerous class was already present in the upstream jackson-databind 2.11.3 release (commit 914e7c9f by tatu.saloranta@iki.fi, dated 2020-02-09). The blocklist entry exists at SubTypeValidator.java:135 and is actively enforced during deserialization, preventing the exploit described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which could lead to arbitrary code execution. The fix (blocking this class from deserialization) was introduced by upstream author Tatu Saloranta in commit 1e64db6a2f and was already present in the upstream 2.11.3 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:138 and is enforced during polymorphic deserialization at BeanDeserializerFactory.java:924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.11.3-tuxcare.4. The vulnerability involves deserialization of the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig, which could lead to arbitrary code execution. The fix (blocking this class from deserialization) was introduced by upstream author Tatu Saloranta in commit 1e64db6a2f and was already present in the upstream 2.11.3 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:138 and is enforced during polymorphic deserialization at BeanDeserializerFactory.java:924.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not affecting this version. The fix (adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the deserialization blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.11.3 release. The target version 2.11.3-tuxcare.4 inherited this fix from the upstream release that TuxCare onboarded, making the vulnerable deserialization gadget pattern absent from the code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not affecting this version. The fix (adding com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig to the deserialization blocklist in SubTypeValidator.java) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.11.3 release. The target version 2.11.3-tuxcare.4 inherited this fix from the upstream release that TuxCare onboarded, making the vulnerable deserialization gadget pattern absent from the code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7, related to the AnterosDBCPConfig deserialization gadget. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT vulnerable because the fix was already present in upstream version 2.11.0, which predates the 2.11.3 release that TuxCare onboarded. The blocklist entry \"br.com.anteros.dbcp.AnterosDBCPConfig\" exists in SubTypeValidator.java at line 142, preventing deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta in commit 1e64db6a2f on February 29, 2020, and shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7, related to the AnterosDBCPConfig deserialization gadget. The target repository (jackson-databind 2.11.3-tuxcare.4) is NOT vulnerable because the fix was already present in upstream version 2.11.0, which predates the 2.11.3 release that TuxCare onboarded. The blocklist entry \"br.com.anteros.dbcp.AnterosDBCPConfig\" exists in SubTypeValidator.java at line 142, preventing deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta in commit 1e64db6a2f on February 29, 2020, and shipped in the upstream release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.11.3-tuxcare.4. The upstream fix adding javax.swing.JTextPane to the deserialization blacklist was committed by FasterXML on Sept 17, 2020 (commit 7dbf51bf78) and shipped in the upstream jackson-databind 2.11.3 release on Oct 1, 2020. TuxCare later onboarded version 2.11.3 which already contained this upstream fix. The vulnerable pattern is not present because the defensive blacklist entry exists and is active on all polymorphic deserialization code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.11.3-tuxcare.4. The upstream fix adding javax.swing.JTextPane to the deserialization blacklist was committed by FasterXML on Sept 17, 2020 (commit 7dbf51bf78) and shipped in the upstream jackson-databind 2.11.3 release on Oct 1, 2020. TuxCare later onboarded version 2.11.3 which already contained this upstream fix. The vulnerable pattern is not present because the defensive blacklist entry exists and is active on all polymorphic deserialization code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:52.236213+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.11.3 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass in unwrapped creator parameters, but this version explicitly rejects the @JsonUnwrapped + @JsonCreator combination at bean definition time with error \"Cannot define Creator property as `@JsonUnwrapped`: combination not yet supported\". The vulnerable code path (UnwrappedPropertyHandler.processUnwrappedC...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.3 is not affected by CVE-2026-54518. The vulnerability concerns @JsonView bypass in unwrapped creator parameters, but this version explicitly rejects the @JsonUnwrapped + @JsonCreator combination at bean definition time with error \"Cannot define Creator property as `@JsonUnwrapped`: combination not yet supported\". The vulnerable code path (UnwrappedPropertyHandler.processUnwrappedC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-59888 affects Java Records when @JsonIgnore is combined with PropertyNamingStrategy - the ignored property name is not propagated through the rename, allowing the renamed JSON key to populate the ignored field. Jackson-databind 2.11.3 targets Java 1.7 and has no Record support (Records require Java 17+). For regular POJOs in 2.11.3, ignored properties are removed from the property map ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59888 affects Java Records when @JsonIgnore is combined with PropertyNamingStrategy - the ignored property name is not propagated through the rename, allowing the renamed JSON key to populate the ignored field. Jackson-databind 2.11.3 targets Java 1.7 and has no Record support (Records require Java 17+). For regular POJOs in 2.11.3, ignored properties are removed from the property map ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.11.3-tuxcare.5 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T10:24:07.902337+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.11.3-tuxcare.5.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}