{
  "@id": "urn:uuid:276d8dd2-0701-4aa4-afe2-01d05b3feb95",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 81,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:06:52.553662+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is NOT present in jackson-databind 2.12.1. The vulnerability affected versions prior to 2.8.11 and 2.9.4. The target version 2.12.1 (released January 2021) already contains the upstream fixes for issues #1680 and #1737 that address this CVE. All seven dangerous gadget classes are protected via SubTypeValidator's blacklist and pattern-based checks. The fixes were authored by upstream maintainer Tatu Saloranta in mid-2017 and shipped in the upstream 2.12.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is NOT present in jackson-databind 2.12.1. The vulnerability affected versions prior to 2.8.11 and 2.9.4. The target version 2.12.1 (released January 2021) already contains the upstream fixes for issues #1680 and #1737 that address this CVE. All seven dangerous gadget classes are protected via SubTypeValidator's blacklist and pattern-based checks. The fixes were authored by upstream maintainer Tatu Saloranta in mid-2017 and shipped in the upstream 2.12.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:44:21.734688+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.12.1. This CVE affected versions 2.8.10 and 2.9.x through 2.9.3 due to an incomplete blacklist for polymorphic deserialization gadgets, particularly when Spring libraries were in the classpath. The fix was applied in upstream versions 2.8.11 and 2.9.4 (December 2017) through patches that created SubTypeValidator and added comprehensive blocklist entries plus pattern-based validation for Spring and C3P0 classes. Version 2.12.1 (released December 2020, nearly 3 years after the fix) already contains the complete upstream fix that shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.12.1. This CVE affected versions 2.8.10 and 2.9.x through 2.9.3 due to an incomplete blacklist for polymorphic deserialization gadgets, particularly when Spring libraries were in the classpath. The fix was applied in upstream versions 2.8.11 and 2.9.4 (December 2017) through patches that created SubTypeValidator and added comprehensive blocklist entries plus pattern-based validation for Spring and C3P0 classes. Version 2.12.1 (released December 2020, nearly 3 years after the fix) already contains the complete upstream fix that shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:27:17.200297+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target repository is version 2.12.1-tuxcare.3, which is significantly newer and already contains the upstream vendor's fix. The vulnerability allowed arbitrary code execution through deserialization of malicious JSON with polymorphic type indicators. The fix introduced a blacklist of dangerous classes (TemplatesImpl, InvokerTransformer, etc.) that are blocked from deserialization. In version 2.12.1, this protection is implemented via the SubTypeValidator class, which contains the same blacklist and is called during bean deserializer creation. The fix was authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) and shipped in the original 2.12.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target repository is version 2.12.1-tuxcare.3, which is significantly newer and already contains the upstream vendor's fix. The vulnerability allowed arbitrary code execution through deserialization of malicious JSON with polymorphic type indicators. The fix introduced a blacklist of dangerous classes (TemplatesImpl, InvokerTransformer, etc.) that are blocked from deserialization. In version 2.12.1, this protection is implemented via the SubTypeValidator class, which contains the same blacklist and is called during bean deserializer creation. The fix was authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) and shipped in the original 2.12.1 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the iBatis XPathParser gadget class that allows data exfiltration. The upstream fix (adding org.apache.ibatis.parsing.XPathParser to the blacklist in SubTypeValidator.java) was included in the upstream 2.12.1 release that TuxCare onboarded. The fix commit 27b4defc270454dea6842bd9279f17387eceb737 by upstream maintainer Tatu Saloranta predates TuxCare's setup commit, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves polymorphic deserialization of the iBatis XPathParser gadget class that allows data exfiltration. The upstream fix (adding org.apache.ibatis.parsing.XPathParser to the blacklist in SubTypeValidator.java) was included in the upstream 2.12.1 release that TuxCare onboarded. The fix commit 27b4defc270454dea6842bd9279f17387eceb737 by upstream maintainer Tatu Saloranta predates TuxCare's setup commit, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:18:37.716688+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.12.1-tuxcare.3 already contains the upstream fix that blacklists the vulnerable Jodd-db class (jodd.db.connection.DataSourceConnectionProvider) in SubTypeValidator.java line 68. The fix was authored by upstream maintainer Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a and was present in the upstream 2.12.1 release before TuxCare onboarded it. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.12.1-tuxcare.3 already contains the upstream fix that blacklists the vulnerable Jodd-db class (jodd.db.connection.DataSourceConnectionProvider) in SubTypeValidator.java line 68. The fix was authored by upstream maintainer Tatu Saloranta in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a and was present in the upstream 2.12.1 release before TuxCare onboarded it. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:20:17.888209+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.12.1-tuxcare.3. The upstream fix (commit 28badf7ef6) that blocklists Oracle JDBC classes oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet was already included in the upstream jackson-databind 2.12.1 release that TuxCare onboarded. The vulnerable deserialization pattern is prevented by SubTypeValidator, which rejects these classes during polymorphic deserialization when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.12.1-tuxcare.3. The upstream fix (commit 28badf7ef6) that blocklists Oracle JDBC classes oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet was already included in the upstream jackson-databind 2.12.1 release that TuxCare onboarded. The vulnerable deserialization pattern is prevented by SubTypeValidator, which rejects these classes during polymorphic deserialization when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability required the absence of \"org.slf4j.ext.EventData\" from the polymorphic deserialization blocklist. The fix (adding this class to the blocklist) is present in SubTypeValidator.java:75 and actively enforced during all polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.1 release, which post-dates all CVE-affected versions (2.9.7, 2.8.11.3, 2.7.9.5, 2.6.7.3). The vulnerable code pattern (missing blocklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability required the absence of \"org.slf4j.ext.EventData\" from the polymorphic deserialization blocklist. The fix (adding this class to the blocklist) is present in SubTypeValidator.java:75 and actively enforced during all polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.1 release, which post-dates all CVE-affected versions (2.9.7, 2.8.11.3, 2.7.9.5, 2.6.7.3). The vulnerable code pattern (missing blocklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:59:41.286358+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is not affected by CVE-2018-14719. The vulnerability concerns the absence of BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) from the polymorphic deserialization blocklist, which could enable arbitrary code execution. The fix\u2014adding these classes to DEFAULT_NO_DESER_CLASS_NAMES\u2014was already present in the upstream Jackson 2.12.1 release that TuxCare onboarded. Git analysis shows the fix was committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 0899726ec34 on 2018-08-16, which predates the first TuxCare commit (5b8bc0e8de6 \"setup 2.12.1\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is not affected by CVE-2018-14719. The vulnerability concerns the absence of BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor and related classes) from the polymorphic deserialization blocklist, which could enable arbitrary code execution. The fix\u2014adding these classes to DEFAULT_NO_DESER_CLASS_NAMES\u2014was already present in the upstream Jackson 2.12.1 release that TuxCare onboarded. Git analysis shows the fix was committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 0899726ec34 on 2018-08-16, which predates the first TuxCare commit (5b8bc0e8de6 \"setup 2.12.1\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:07:52.803278+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.12.1. The vulnerability required blocking four specific classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization to prevent XXE and other attacks. These classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 74-78) and actively enforced via BeanDeserializerFactory. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and shipped in the upstream release 2.12.1, which TuxCare onboarded without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.12.1. The vulnerability required blocking four specific classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) from polymorphic deserialization to prevent XXE and other attacks. These classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 74-78) and actively enforced via BeanDeserializerFactory. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and shipped in the upstream release 2.12.1, which TuxCare onboarded without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability allowed SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl gadget class. The upstream vendor fix (commit 87d29af25e by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.12.1 release that TuxCare onboarded. The blocklist entry is present at line 78 of SubTypeValidator.java and is actively enforced during polymorphic deserialization via BeanDeserializerFactory._validateSubType(), which throws a security exception when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability allowed SSRF attacks via polymorphic deserialization of the org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl gadget class. The upstream vendor fix (commit 87d29af25e by Tatu Saloranta) added this class to the deserialization blocklist in SubTypeValidator.java, and this fix was already included in the upstream jackson-databind 2.12.1 release that TuxCare onboarded. The blocklist entry is present at line 78 of SubTypeValidator.java and is actively enforced during polymorphic deserialization via BeanDeserializerFactory._validateSubType(), which throws a security exception when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:47:30.687322+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. Target version 2.12.1 is NOT AFFECTED because the fix was already included in the upstream 2.12.1 release. The blocklist entry is present at SubTypeValidator.java:85, added by upstream commit 72cd4025a22 (Fix #2186) authored by Tatu Saloranta on 2018-11-19. This commit predates TuxCare's onboarding of version 2.12.1 (first TuxCare commit 5b8bc0e8de \"setup 2.12.1\" by askorik@cloudlinux.com). The defense is actively enforced via BeanDeserializerFactory.validateSubType() during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo in polymorphic deserialization. Target version 2.12.1 is NOT AFFECTED because the fix was already included in the upstream 2.12.1 release. The blocklist entry is present at SubTypeValidator.java:85, added by upstream commit 72cd4025a22 (Fix #2186) authored by Tatu Saloranta on 2018-11-19. This commit predates TuxCare's onboarding of version 2.12.1 (first TuxCare commit 5b8bc0e8de \"setup 2.12.1\" by askorik@cloudlinux.com). The defense is actively enforced via BeanDeserializerFactory.validateSubType() during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:55:41.476005+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.12.1. The vulnerability involves failure to block openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. The upstream fix was applied in version 2.9.8 by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. Target version 2.12.1 already contains this fix from the upstream release (commit 72cd4025a2 by Tatu Saloranta), and the openjpa classes are present in the blocklist at lines 82-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.12.1. The vulnerability involves failure to block openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. The upstream fix was applied in version 2.9.8 by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. Target version 2.12.1 already contains this fix from the upstream release (commit 72cd4025a2 by Tatu Saloranta), and the openjpa classes are present in the blocklist at lines 82-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:24:24.833839+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves polymorphic deserialization of jboss-common-core's DocumentEditor class. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in the upstream release 2.12.1 before TuxCare onboarded it. The fix adds \"org.jboss.util.propertyeditor.DocumentEditor\" to SubTypeValidator's blocklist, preventing its deserialization. Code verification confirms the blocklist entry is present (SubTypeValidator.java line 81) and actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves polymorphic deserialization of jboss-common-core's DocumentEditor class. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) was already included in the upstream release 2.12.1 before TuxCare onboarded it. The fix adds \"org.jboss.util.propertyeditor.DocumentEditor\" to SubTypeValidator's blocklist, preventing its deserialization. Code verification confirms the blocklist entry is present (SubTypeValidator.java line 81) and actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.12.1. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass Jackson's deserialization blacklist to achieve remote code execution. The upstream fix, which added these classes to the blacklist in SubTypeValidator.java, was committed by Tatu Saloranta on January 21, 2018 (commit 038b471e2e) and included in upstream releases starting from 2.10.0. Since the target is version 2.12.1, the fix was already present in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.12.1. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass Jackson's deserialization blacklist to achieve remote code execution. The upstream fix, which added these classes to the blacklist in SubTypeValidator.java, was committed by Tatu Saloranta on January 21, 2018 (commit 038b471e2e) and included in upstream releases starting from 2.10.0. Since the target is version 2.12.1, the fix was already present in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:05.554172+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.9.5 (and earlier branches). The target version 2.12.1-tuxcare.3 already contains the upstream fix from February 2018 (commit 6799f8f10c by Tatu Saloranta). The fix adds validation in SubTypeValidator.java that blocks deserialization of any c3p0 class matching the pattern com.mchange.v2.c3p0.*DataSource, preventing the RCE gadget chain exploitation. This fix was present in the upstream jackson-databind 2.12.1 release (December 2020) that TuxCare onboarded in October 2025, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.9.5 (and earlier branches). The target version 2.12.1-tuxcare.3 already contains the upstream fix from February 2018 (commit 6799f8f10c by Tatu Saloranta). The fix adds validation in SubTypeValidator.java that blocks deserialization of any c3p0 class matching the pattern com.mchange.v2.c3p0.*DataSource, preventing the RCE gadget chain exploitation. This fix was present in the upstream jackson-databind 2.12.1 release (December 2020) that TuxCare onboarded in October 2025, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:32:27.596761+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.1-tuxcare.3) is not affected by CVE-2019-12086. The vulnerability was fixed in upstream jackson-databind version 2.9.9 by adding com.mysql.cj.jdbc.admin.MiniAdmin to the deserialization blocklist in SubTypeValidator.java. Since the target version 2.12.1 is greater than 2.9.9, the fix was already present in the upstream release when TuxCare onboarded this version via the setup commit (5b8bc0e8de). The vulnerable pattern (absence of MiniAdmin from the blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.1-tuxcare.3) is not affected by CVE-2019-12086. The vulnerability was fixed in upstream jackson-databind version 2.9.9 by adding com.mysql.cj.jdbc.admin.MiniAdmin to the deserialization blocklist in SubTypeValidator.java. Since the target version 2.12.1 is greater than 2.9.9, the fix was already present in the upstream release when TuxCare onboarded this version via the setup commit (5b8bc0e8de). The vulnerable pattern (absence of MiniAdmin from the blocklist) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:33:00.155354+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource in jackson-databind. The upstream fix (commit c9ef4a10d6) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.12.1, which predates the TuxCare branch creation (first TuxCare commi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 concerns polymorphic deserialization of the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource in jackson-databind. The upstream fix (commit c9ef4a10d6) adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.12.1, which predates the TuxCare branch creation (first TuxCare commi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:15:16.086271+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.12.1 is not affected by CVE-2019-12814. The vulnerability was fixed in upstream version 2.9.9.1 (June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.1 release (December 2020) that TuxCare onboarded, as confirmed by g...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.12.1 is not affected by CVE-2019-12814. The vulnerability was fixed in upstream version 2.9.9.1 (June 2019) by adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.1 release (December 2020) that TuxCare onboarded, as confirmed by g..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is NOT affected by CVE-2019-14379. The vulnerability pattern (missing blacklist entries for dangerous ehcache classes) is not present because the upstream fix was already included in version 2.12.1 before TuxCare onboarding. The fix commit ad418eeb97 by Tatu Saloranta (upstream maintainer) added the required blacklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator.java, preventing deserialization gadget attacks via these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is NOT affected by CVE-2019-14379. The vulnerability pattern (missing blacklist entries for dangerous ehcache classes) is not present because the upstream fix was already included in version 2.12.1 before TuxCare onboarding. The fix commit ad418eeb97 by Tatu Saloranta (upstream maintainer) added the required blacklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to SubTypeValidator.java, preventing deserialization gadget attacks via these classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 (polymorphic typing issue allowing deserialization of logback JNDIConnectionSource) is not present in jackson-databind 2.12.1-tuxcare.3. The fix was included in the upstream release that TuxCare onboarded. The vulnerable class `ch.qos.logback.core.db.JNDIConnectionSource` is blacklisted in SubTypeValidator.java (line 102), preventing its deserialization even when Default Typing is enabled. This fix was committed by upstream maintainer Tatu Saloranta on 2019-07-25 in commit ad418eeb97, which is an ancestor of the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\"), confirming it shipped with the upstream 2.12.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 (polymorphic typing issue allowing deserialization of logback JNDIConnectionSource) is not present in jackson-databind 2.12.1-tuxcare.3. The fix was included in the upstream release that TuxCare onboarded. The vulnerable class `ch.qos.logback.core.db.JNDIConnectionSource` is blacklisted in SubTypeValidator.java (line 102), preventing its deserialization even when Default Typing is enabled. This fix was committed by upstream maintainer Tatu Saloranta on 2019-07-25 in commit ad418eeb97, which is an ancestor of the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\"), confirming it shipped with the upstream 2.12.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:47:24.883937+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves unsafe deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource via polymorphic typing. The upstream fix (commits d4983c740f and 73c1c2cc76) blocked these classes in SubTypeValidator.java and was already included in the upstream 2.12.1 release that TuxCare onboarded. Both HikariConfig and HikariDataSource are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 105, 107), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves unsafe deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource via polymorphic typing. The upstream fix (commits d4983c740f and 73c1c2cc76) blocked these classes in SubTypeValidator.java and was already included in the upstream 2.12.1 release that TuxCare onboarded. Both HikariConfig and HikariDataSource are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (lines 105, 107), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:54:24.198988+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.12.1-tuxcare.3 is NOT affected by CVE-2019-14892. The upstream fix that adds blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration was already present in the upstream release 2.12.1 before TuxCare onboarded it. The vulnerable code pattern (ability to deserialize these JNDI classes via polymorphic deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "The target repository jackson-databind version 2.12.1-tuxcare.3 is NOT affected by CVE-2019-14892. The upstream fix that adds blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration was already present in the upstream release 2.12.1 before TuxCare onboarded it. The vulnerable code pattern (ability to deserialize these JNDI classes via polymorphic deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is NOT affected by CVE-2019-14893. The xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) is already blocked in SubTypeValidator.java line 117. This fix was introduced by upstream maintainer Tatu Saloranta in commit 998efd7082 as part of jackson-databind 2.9.10, which shipped before TuxCare's setup of version 2.12.1. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is NOT affected by CVE-2019-14893. The xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) is already blocked in SubTypeValidator.java line 117. This fix was introduced by upstream maintainer Tatu Saloranta in commit 998efd7082 as part of jackson-databind 2.9.10, which shipped before TuxCare's setup of version 2.12.1. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:04:40.164782+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.1-tuxcare.3 is not affected by CVE-2019-16335. The vulnerability concerns polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to code execution. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was included in upstream jackson-databind 2.12.1, released by FasterXML maintainer Tatu Saloranta. The TuxCare version is based on this already-fixed upstream release. The blocklist entry at SubTypeValidator.java:107 prevents deserialization of this gadget type.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "Target version 2.12.1-tuxcare.3 is not affected by CVE-2019-16335. The vulnerability concerns polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to code execution. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was included in upstream jackson-databind 2.12.1, released by FasterXML maintainer Tatu Saloranta. The TuxCare version is based on this already-fixed upstream release. The blocklist entry at SubTypeValidator.java:107 prevents deserialization of this gadget type.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:04:56.336983+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves unsafe polymorphic deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) that can lead to remote code execution when Default Typing is enabled. The fix (blocklisting these dangerous classes in SubTypeValidator) was already present in the upstream 2.12.1 release that TuxCare onboarded. The target version contains the fix at SubTypeValidator.java:121-128, added by upstream commits 328a0f833da and 9593e16cf5a (authored by tatu.saloranta@iki.fi, 2019-09-28), which predate the first TuxCare commit 5b8bc0e8de (\"setup 2.12.1\"). The vulnerable code pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves unsafe polymorphic deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) that can lead to remote code execution when Default Typing is enabled. The fix (blocklisting these dangerous classes in SubTypeValidator) was already present in the upstream 2.12.1 release that TuxCare onboarded. The target version contains the fix at SubTypeValidator.java:121-128, added by upstream commits 328a0f833da and 9593e16cf5a (authored by tatu.saloranta@iki.fi, 2019-09-28), which predate the first TuxCare commit 5b8bc0e8de (\"setup 2.12.1\"). The vulnerable code pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:14:51.865228+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is NOT AFFECTED by CVE-2019-16943. The vulnerability required the absence of blocklist entries for com.p6spy.engine.spy.P6DataSource and org.apache.commons.dbcp.datasources classes in SubTypeValidator. These blocklist entries are present in the target at SubTypeValidator.java lines 124-127, blocking deserialization of the dangerous gadget classes. The fix was authored by the upstream maintainer Tatu Saloranta (commit 9593e16cf5) on 2019-09-28 and shipped in upstream jackson-databind 2.12.1, which TuxCare later onboarded. The vulnerable pattern (missing blocklist) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is NOT AFFECTED by CVE-2019-16943. The vulnerability required the absence of blocklist entries for com.p6spy.engine.spy.P6DataSource and org.apache.commons.dbcp.datasources classes in SubTypeValidator. These blocklist entries are present in the target at SubTypeValidator.java lines 124-127, blocking deserialization of the dangerous gadget classes. The fix was authored by the upstream maintainer Tatu Saloranta (commit 9593e16cf5) on 2019-09-28 and shipped in upstream jackson-databind 2.12.1, which TuxCare later onboarded. The vulnerable pattern (missing blocklist) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.12.1-tuxcare.3) is not affected by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (adding this class to the SubTypeValidator blocklist) is present in the target at line 99 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b and was already included in the upstream jackson-databind 2.12.1 release that TuxCare onboarded, predating all TuxCare modifications to this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target repository (jackson-databind 2.12.1-tuxcare.3) is not affected by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The fix (adding this class to the SubTypeValidator blocklist) is present in the target at line 99 of SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta in commit 191a4cdf87b and was already included in the upstream jackson-databind 2.12.1 release that TuxCare onboarded, predating all TuxCare modifications to this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:47:45.865837+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is not present in jackson-databind 2.12.1-tuxcare.3. The fix for this polymorphic typing deserialization vulnerability was included in the upstream 2.12.1 release. The patch adds blocklist entries for org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to SubTypeValidator, preventing their deserialization when Default Typing is enabled. The fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream maintainer Tatu Saloranta is present in the target and was part of the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is not present in jackson-databind 2.12.1-tuxcare.3. The fix for this polymorphic typing deserialization vulnerability was included in the upstream 2.12.1 release. The patch adds blocklist entries for org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to SubTypeValidator, preventing their deserialization when Default Typing is enabled. The fix commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by upstream maintainer Tatu Saloranta is present in the target and was part of the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.1-tuxcare.3 is not affected by CVE-2019-20330. The vulnerability concerns missing blocklist entries for ehcache JNDI gadget classes (GenericJndiSelector and GlassfishSelector) that enable deserialization attacks. The upstream fix (commit eb254813cc by Tatu Saloranta, Nov 1 2019) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.12.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of TuxCare's first commit (5b8bc0e8de \"setup 2.12.1\"). The CVE affects versions before 2.9.10.2, while 2.12.1 is significantly newer and ships with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "Target version 2.12.1-tuxcare.3 is not affected by CVE-2019-20330. The vulnerability concerns missing blocklist entries for ehcache JNDI gadget classes (GenericJndiSelector and GlassfishSelector) that enable deserialization attacks. The upstream fix (commit eb254813cc by Tatu Saloranta, Nov 1 2019) added these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream 2.12.1 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of TuxCare's first commit (5b8bc0e8de \"setup 2.12.1\"). The CVE affects versions before 2.9.10.2, while 2.12.1 is significantly newer and ships with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:58.863426+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4, where unsafe deserialization of ignite-jta gadget classes could lead to JNDI injection and remote code execution. The target version 2.12.1-tuxcare.3 is NOT affected because it already contains the upstream fix (commit a424c038ba by tatu.saloranta@iki.fi) that was shipped in the upstream 2.12.1 release. The fix adds three class names to the deserialization blocklist in SubTypeValidator.java (lines 158-160): org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. The validation logic is actively invoked during bean deserialization and blocks these classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4, where unsafe deserialization of ignite-jta gadget classes could lead to JNDI injection and remote code execution. The target version 2.12.1-tuxcare.3 is NOT affected because it already contains the upstream fix (commit a424c038ba by tatu.saloranta@iki.fi) that was shipped in the upstream 2.12.1 release. The fix adds three class names to the deserialization blocklist in SubTypeValidator.java (lines 158-160): org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. The validation logic is actively invoked during bean deserialization and blocks these classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is NOT VULNERABLE to CVE-2020-10672. The vulnerability pattern has been removed by an upstream fix (commit 592872f4) authored by Tatu Saloranta that was already present in the jackson-databind 2.12.1 release before TuxCare onboarding. The fix adds org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 162-164), preventing their instantiation during polymorphic deserialization and blocking the attack chain from malicious JSON payloads to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is NOT VULNERABLE to CVE-2020-10672. The vulnerability pattern has been removed by an upstream fix (commit 592872f4) authored by Tatu Saloranta that was already present in the jackson-databind 2.12.1 release before TuxCare onboarding. The fix adds org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 162-164), preventing their instantiation during polymorphic deserialization and blocking the attack chain from malicious JSON payloads to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:26:23.100345+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves missing blocklist protection for the deserialization gadget com.caucho.config.types.ResourceRef. The upstream fix (adding this class to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java) was already present in the upstream release 2.12.1 when TuxCare onboarded it. The fix is at line 167 of SubTypeValidator.java and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). The CVE affects versions before 2.9.10.4; target version 2.12.1 is well beyond that threshold. Fix commit 1645efbd39 by upstream maintainer tatu.saloranta@iki.fi (dated 2020-03-17) predates TuxCare's onboarding by over 5 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves missing blocklist protection for the deserialization gadget com.caucho.config.types.ResourceRef. The upstream fix (adding this class to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java) was already present in the upstream release 2.12.1 when TuxCare onboarded it. The fix is at line 167 of SubTypeValidator.java and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType(). The CVE affects versions before 2.9.10.4; target version 2.12.1 is well beyond that threshold. Fix commit 1645efbd39 by upstream maintainer tatu.saloranta@iki.fi (dated 2020-03-17) predates TuxCare's onboarding by over 5 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is not present in jackson-databind 2.12.1-tuxcare.3. The fix for this vulnerability was included in the upstream jackson-databind 2.12.1 release (commit 05d7e0e13f by Tatu Saloranta), which added blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider to SubTypeValidator.java. TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 is not present in jackson-databind 2.12.1-tuxcare.3. The fix for this vulnerability was included in the upstream jackson-databind 2.12.1 release (commit 05d7e0e13f by Tatu Saloranta), which added blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider to SubTypeValidator.java. TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1 already contains the upstream fix for CVE-2020-10969. The vulnerability involved using javax.swing.JEditorPane as a deserialization gadget to achieve arbitrary code execution. The fix (commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 by upstream maintainer Tatu Saloranta) adds \"javax.swing.JEditorPane\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of this class. This fix was present in the upstream 2.12.1 release before TuxCare onboarded it, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target jackson-databind 2.12.1 already contains the upstream fix for CVE-2020-10969. The vulnerability involved using javax.swing.JEditorPane as a deserialization gadget to achieve arbitrary code execution. The fix (commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 by upstream maintainer Tatu Saloranta) adds \"javax.swing.JEditorPane\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of this class. This fix was present in the upstream 2.12.1 release before TuxCare onboarded it, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves deserialization of malicious org.apache.activemq.* gadget classes via JSON with polymorphic type information. The fix (blacklisting 9 activemq classes in SubTypeValidator) was already present in the upstream 2.12.1 release before TuxCare onboarded it. Fix commit c14c9f99ed by upstream maintainer Tatu Saloranta predates the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\") by 1397 commits. The defense is properly implemented: SubTypeValidator.validateSubType checks class names against DEFAULT_NO_DESER_CLASS_NAMES and throws JsonMappingException for blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves deserialization of malicious org.apache.activemq.* gadget classes via JSON with polymorphic type information. The fix (blacklisting 9 activemq classes in SubTypeValidator) was already present in the upstream 2.12.1 release before TuxCare onboarded it. Fix commit c14c9f99ed by upstream maintainer Tatu Saloranta predates the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\") by 1397 commits. The defense is properly implemented: SubTypeValidator.validateSubType checks class names against DEFAULT_NO_DESER_CLASS_NAMES and throws JsonMappingException for blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.12.1. The fix (blocklisting org.apache.commons.proxy.provider.remoting.RmiProvider in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 and shipped in upstream release 2.9.10.4. Target version 2.12.1 inherited this fix from the upstream release. The blocklist entry at line 186 of SubTypeValidator.java prevents deserialization of the dangerous RmiProvider gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.12.1. The fix (blocklisting org.apache.commons.proxy.provider.remoting.RmiProvider in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 and shipped in upstream release 2.9.10.4. Target version 2.12.1 inherited this fix from the upstream release. The blocklist entry at line 186 of SubTypeValidator.java prevents deserialization of the dangerous RmiProvider gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository is jackson-databind 2.12.1-tuxcare.3. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) added the dangerous class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.1 release that TuxCare onboarded (first TuxCare commit: 5b8bc0e8de \"setup 2.12.1\"), meaning the vulnerable code pattern was never present in this version. The fix author/committer are both tatu.saloranta@iki.fi (not a TuxCare domain), confirming this is an upstream fix that shipped in the original release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.openjpa.ee.WASRegistryManagedRuntime. The target repository is jackson-databind 2.12.1-tuxcare.3. The upstream fix (commit e2ba12d5d6 by Tatu Saloranta) added the dangerous class to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.1 release that TuxCare onboarded (first TuxCare commit: 5b8bc0e8de \"setup 2.12.1\"), meaning the vulnerable code pattern was never present in this version. The fix author/committer are both tatu.saloranta@iki.fi (not a TuxCare domain), confirming this is an upstream fix that shipped in the original release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind 2.x before 2.9.10.4 due to deserialization gadgets in org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The target version 2.12.1-tuxcare.3 already contains the upstream fix (commit 113e89fb08 by Tatu Saloranta) that was shipped in upstream release 2.12.1, which TuxCare onboarded. The fix adds both class names to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 52-54), preventing deserialization of these gadget types. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind 2.x before 2.9.10.4 due to deserialization gadgets in org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The target version 2.12.1-tuxcare.3 already contains the upstream fix (commit 113e89fb08 by Tatu Saloranta) that was shipped in upstream release 2.12.1, which TuxCare onboarded. The fix adds both class names to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 52-54), preventing deserialization of these gadget types. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.12.1-tuxcare.3 is not affected by CVE-2020-11620. The vulnerability was fixed in upstream jackson-databind 2.9.10.4 (commit 77040d85e3 by Tatu Saloranta) which added org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.1 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "Target version 2.12.1-tuxcare.3 is not affected by CVE-2020-11620. The vulnerability was fixed in upstream jackson-databind 2.9.10.4 (commit 77040d85e3 by Tatu Saloranta) which added org.apache.commons.jelly.impl.Embedded to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.12.1 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to missing blacklist entries for deserialization gadget classes. The target version 2.12.1-tuxcare.3 already contains the upstream fix that adds `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` and related classes to the deserialization blacklist in SubTypeValidator.java (lines 192-195). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit d1c67a0 and shipped in the upstream 2.12.1 release before TuxCare onboarded this version. The blacklist-based defense is active by default and prevents deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to missing blacklist entries for deserialization gadget classes. The target version 2.12.1-tuxcare.3 already contains the upstream fix that adds `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` and related classes to the deserialization blacklist in SubTypeValidator.java (lines 192-195). The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit d1c67a0 and shipped in the upstream 2.12.1 release before TuxCare onboarded this version. The blacklist-based defense is active by default and prevents deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind versions before 2.9.10.5 due to unsafe deserialization of Oracle JMS connection factory classes (oracle.jms.AQjms*). The target repository (jackson-databind 2.12.1-tuxcare.3) already contains the upstream vendor fix in SubTypeValidator.java, which blocks deserialization of all five Oracle JMS classes listed in the CVE. The fix was included in the upstream FasterXML jackson-databind 2.12.1 release (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta, April 24, 2020), before any TuxCare modifications to this version. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 affects jackson-databind versions before 2.9.10.5 due to unsafe deserialization of Oracle JMS connection factory classes (oracle.jms.AQjms*). The target repository (jackson-databind 2.12.1-tuxcare.3) already contains the upstream vendor fix in SubTypeValidator.java, which blocks deserialization of all five Oracle JMS classes listed in the CVE. The fix was included in the upstream FasterXML jackson-databind 2.12.1 release (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta, April 24, 2020), before any TuxCare modifications to this version. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.12.1-tuxcare.3 is well beyond this threshold. The upstream fix (commit 840eae2ca8 by Tatu Saloranta) that adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the SubTypeValidator denylist was already present in jackson-databind 2.12.1 before TuxCare onboarded this version. The vulnerable deserialization pattern is not present because the upstream vendor fixed it prior to the 2.12.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.12.1-tuxcare.3 is well beyond this threshold. The upstream fix (commit 840eae2ca8 by Tatu Saloranta) that adds com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to the SubTypeValidator denylist was already present in jackson-databind 2.12.1 before TuxCare onboarded this version. The vulnerable deserialization pattern is not present because the upstream vendor fixed it prior to the 2.12.1 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 does not affect jackson-databind 2.12.1-tuxcare.3. The vulnerability was fixed in upstream commit f6d9c664f6d (2020-06-13) by adding org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blacklist in SubTypeValidator.java. This fix was included in the upstream jackson-databind 2.12.1 release (2021-01-08), which TuxCare later onboarded in 2025. The fix is present at SubTypeValidator.java:207 in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 does not affect jackson-databind 2.12.1-tuxcare.3. The vulnerability was fixed in upstream commit f6d9c664f6d (2020-06-13) by adding org.jsecurity.realm.jndi.JndiRealmFactory to the deserialization blacklist in SubTypeValidator.java. This fix was included in the upstream jackson-databind 2.12.1 release (2021-01-08), which TuxCare later onboarded in 2025. The fix is present at SubTypeValidator.java:207 in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:19:24.952513+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target version 2.12.1 already contains the upstream fix (commit 3d97153944 by Tatu Saloranta, merged Aug 10, 2020). The fix adds br.com.anteros.dbcp.AnterosDBCPDataSource to the SubTypeValidator blacklist at line 147, preventing deserialization of this gadget class. This fix was included in the upstream 2.12.1 release (Jan 8, 2021) before TuxCare onboarded the version (Oct 30, 2025), making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6. The target version 2.12.1 already contains the upstream fix (commit 3d97153944 by Tatu Saloranta, merged Aug 10, 2020). The fix adds br.com.anteros.dbcp.AnterosDBCPDataSource to the SubTypeValidator blacklist at line 147, preventing deserialization of this gadget class. This fix was included in the upstream 2.12.1 release (Jan 8, 2021) before TuxCare onboarded the version (Oct 30, 2025), making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:02.250684+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.12.1-tuxcare.3 is NOT affected by CVE-2020-24750. The fix (blocking com.pastdev.httpcomponents.configuration.JndiConfiguration) is present at SubTypeValidator.java:210. This fix was introduced by upstream commit 6cc9f1a1af3 (author: tatu.saloranta@iki.fi, 2020-07-20), which predates the upstream 2.12.1 release (Dec 2020). TuxCare onboarded 2.12.1 with the fix already present. The vulnerable pattern (missing blocklist entry allowing gadget deserialization) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "Target jackson-databind 2.12.1-tuxcare.3 is NOT affected by CVE-2020-24750. The fix (blocking com.pastdev.httpcomponents.configuration.JndiConfiguration) is present at SubTypeValidator.java:210. This fix was introduced by upstream commit 6cc9f1a1af3 (author: tatu.saloranta@iki.fi, 2020-07-20), which predates the upstream 2.12.1 release (Dec 2020). TuxCare onboarded 2.12.1 with the fix already present. The vulnerable pattern (missing blocklist entry allowing gadget deserialization) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is NOT AFFECTED by CVE-2020-25649 (XXE vulnerability). The fix was already present in the upstream jackson-databind 2.12.1 release that TuxCare onboarded. Commit 612f971b78 by upstream maintainer Tatu Saloranta added XXE protections to DOMDeserializer on January 9, 2020, and this fix shipped in jackson-databind 2.11.0 and all subsequent versions including 2.12.1. The defensive code blocks DOCTYPE declarations and prevents external DTD loading, eliminating the XXE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is NOT AFFECTED by CVE-2020-25649 (XXE vulnerability). The fix was already present in the upstream jackson-databind 2.12.1 release that TuxCare onboarded. Commit 612f971b78 by upstream maintainer Tatu Saloranta added XXE protections to DOMDeserializer on January 9, 2020, and this fix shipped in jackson-databind 2.11.0 and all subsequent versions including 2.12.1. The defensive code blocks DOCTYPE declarations and prevents external DTD loading, eliminating the XXE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:20:46.497840+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository jackson-databind 2.12.1-tuxcare.3 is NOT affected because the fix was already present in the upstream 2.12.1 release. The vulnerable code pattern was never present in this version - the fix (commit 41b8bdb5cc by upstream author Tatu Saloranta) was included in the upstream release before TuxCare onboarded version 2.12.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository jackson-databind 2.12.1-tuxcare.3 is NOT affected because the fix was already present in the upstream 2.12.1 release. The vulnerable code pattern was never present in this version - the fix (commit 41b8bdb5cc by upstream author Tatu Saloranta) was included in the upstream release before TuxCare onboarded version 2.12.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:10.404462+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.12.1-tuxcare.3 is NOT affected by CVE-2020-35491. The upstream vendor fix (blocking deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) was already present in the upstream 2.12.1 release when TuxCare onboarded it. The blocklist entries exist in SubTypeValidator.java at lines 217-218, added by upstream commit 41b8bdb5ccc (author: tatu.saloranta@iki.fi, date: 2020-12-15). This commit is an ancestor of the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\"), confirming it shipped in the upstream release. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "The target jackson-databind version 2.12.1-tuxcare.3 is NOT affected by CVE-2020-35491. The upstream vendor fix (blocking deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) was already present in the upstream 2.12.1 release when TuxCare onboarded it. The blocklist entries exist in SubTypeValidator.java at lines 217-218, added by upstream commit 41b8bdb5ccc (author: tatu.saloranta@iki.fi, date: 2020-12-15). This commit is an ancestor of the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\"), confirming it shipped in the upstream release. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:54:00.210651+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT AFFECTING jackson-databind 2.12.1-tuxcare.3. The vulnerability concerns a missing blocklist entry for the deserialization gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool'. The upstream fix (commit 1ca0388c2f by Tatu Saloranta, dated 2020-12-26) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.12.1 release (released 2021-01-17), which predates TuxCare's onboarding of version 2.12.1 on 2025-10-30. The target repository contains the fix at line 240 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is NOT AFFECTING jackson-databind 2.12.1-tuxcare.3. The vulnerability concerns a missing blocklist entry for the deserialization gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool'. The upstream fix (commit 1ca0388c2f by Tatu Saloranta, dated 2020-12-26) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.12.1 release (released 2021-01-17), which predates TuxCare's onboarding of version 2.12.1 on 2025-10-30. The target repository contains the fix at line 240 of SubTypeValidator.java, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:14.873847+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.12.1-tuxcare.3. The fix (commit 3ded28aece) was committed upstream on 2020-12-31 and included in the upstream 2.12.1 release (2021-01-08). All five DriverAdapterCPDS class name variants are present in the SubTypeValidator blocklist at lines 123, 193, 219, 228, and 234, preventing their deserialization via the validateSubType() security mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.12.1-tuxcare.3. The fix (commit 3ded28aece) was committed upstream on 2020-12-31 and included in the upstream 2.12.1 release (2021-01-08). All five DriverAdapterCPDS class name variants are present in the SubTypeValidator blocklist at lines 123, 193, 219, 228, and 234, preventing their deserialization via the validateSubType() security mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 affects jackson-databind versions that lack blocklist entries for DriverAdapterCPDS gadget classes. The target repository (jackson-databind 2.12.1-tuxcare.3) contains the complete fix from upstream commit 3ded28aece, which was authored by Tatu Saloranta and shipped in the original jackson-databind 2.12.1 release. All five DriverAdapterCPDS class variants are present in the SubTypeValidator blocklist, preventing their deserialization. The vulnerable pattern (missing blocklist entries) does not exist in this version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 affects jackson-databind versions that lack blocklist entries for DriverAdapterCPDS gadget classes. The target repository (jackson-databind 2.12.1-tuxcare.3) contains the complete fix from upstream commit 3ded28aece, which was authored by Tatu Saloranta and shipped in the original jackson-databind 2.12.1 release. All five DriverAdapterCPDS class variants are present in the SubTypeValidator blocklist, preventing their deserialization. The vulnerable pattern (missing blocklist entries) does not exist in this version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:41:26.898836+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability, which allowed deserialization of dangerous gadget classes including org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, was fixed in upstream commit 3ded28aece (Dec 31, 2020) and included in the upstream 2.12.1 release (Jan 8, 2021). The fix adds multiple DriverAdapterCPDS class variants to the SubTypeValidator blacklist, preventing their instantiation during polymorphic deserialization. This upstream fix was already present when TuxCare onboarded version 2.12.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability, which allowed deserialization of dangerous gadget classes including org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, was fixed in upstream commit 3ded28aece (Dec 31, 2020) and included in the upstream 2.12.1 release (Jan 8, 2021). The fix adds multiple DriverAdapterCPDS class variants to the SubTypeValidator blacklist, preventing their instantiation during polymorphic deserialization. This upstream fix was already present when TuxCare onboarded version 2.12.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:02.519749+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerable gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS is already blocked in SubTypeValidator.java (line 234). This fix was introduced by upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b (authored by tatu.saloranta@iki.fi on 2020-12-31) and was already present in the upstream 2.12.1 release when TuxCare onboarded it via commit 5b8bc0e8de (\"setup 2.12.1\" by askorik@cloudlinux.com). The blocklist is actively enforced during deserialization via BeanDeserializerFactory._validateSubType, which delegates to SubTypeValidator.instance().validateSubType and throws an exception for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerable gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS is already blocked in SubTypeValidator.java (line 234). This fix was introduced by upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b (authored by tatu.saloranta@iki.fi on 2020-12-31) and was already present in the upstream 2.12.1 release when TuxCare onboarded it via commit 5b8bc0e8de (\"setup 2.12.1\" by askorik@cloudlinux.com). The blocklist is actively enforced during deserialization via BeanDeserializerFactory._validateSubType, which delegates to SubTypeValidator.instance().validateSubType and throws an exception for blocked classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:56.878680+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 affects jackson-databind versions that allow deserialization of the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class, enabling JNDI injection attacks. The fix adds this class to jackson-databind's deserialization blocklist. Analysis confirms the fix is present in the target (SubTypeValidator.java:243) and was included in upstream release 2.12.1 on 2021-01-08, before TuxCare onboarded it. The blocklist is enforced during deserializer creation and blocks the gadget class by throwing an exception. Target version 2.12.1-tuxcare.3 is not affected because the vulnerability was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 affects jackson-databind versions that allow deserialization of the org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class, enabling JNDI injection attacks. The fix adds this class to jackson-databind's deserialization blocklist. Analysis confirms the fix is present in the target (SubTypeValidator.java:243) and was included in upstream release 2.12.1 on 2021-01-08, before TuxCare onboarded it. The blocklist is enforced during deserializer creation and blocks the gadget class by throwing an exception. Target version 2.12.1-tuxcare.3 is not affected because the vulnerability was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 (jackson-databind deserialization gadget for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource/SharedPoolDataSource) is NOT present in target version 2.12.1. The upstream fix (commit 567194c53a by Tatu Saloranta) was already included in jackson-databind 2.12.1 release before TuxCare onboarded it. The blocklist entries preventing deserialization of these gadget classes are present and enforced in SubTypeValidator.java. Target version 2.12.1 > 2.9.10.8 (first fixed version per CVE).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 (jackson-databind deserialization gadget for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource/SharedPoolDataSource) is NOT present in target version 2.12.1. The upstream fix (commit 567194c53a by Tatu Saloranta) was already included in jackson-databind 2.12.1 release before TuxCare onboarded it. The blocklist entries preventing deserialization of these gadget classes are present and enforced in SubTypeValidator.java. Target version 2.12.1 > 2.9.10.8 (first fixed version per CVE).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:05:19.852884+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The target version 2.12.1 is NOT affected because the upstream release already contains the fix. The required blocklist entries are present in SubTypeValidator.java lines 232-236, having been included in the upstream 2.12.1 release (commit 3dabdfaaeb by tatu.saloranta@iki.fi) before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The target version 2.12.1 is NOT affected because the upstream release already contains the fix. The required blocklist entries are present in SubTypeValidator.java lines 232-236, having been included in the upstream 2.12.1 release (commit 3dabdfaaeb by tatu.saloranta@iki.fi) before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:30:21.985032+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves deserialization gadgets (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable unauthorized operations. The fix commit 3e8fa3beea, which adds these classes to the SubTypeValidator blacklist, is present in HEAD. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.1 release before TuxCare onboarding. The blacklist mechanism (SubTypeValidator.java lines 229-230, 269) blocks deserialization of these dangerous classes by rejecting type metadata before object instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is NOT present in jackson-databind 2.12.1-tuxcare.3. The vulnerability involves deserialization gadgets (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable unauthorized operations. The fix commit 3e8fa3beea, which adds these classes to the SubTypeValidator blacklist, is present in HEAD. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.12.1 release before TuxCare onboarding. The blacklist mechanism (SubTypeValidator.java lines 229-230, 269) blocks deserialization of these dangerous classes by rejecting type metadata before object instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:43:50.613659+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource, which could enable deserialization gadget attacks. The target repository at version 2.12.1-tuxcare.3 is NOT AFFECTED because the fix (adding these classes to the SubTypeValidator blocklist) was already present in the upstream 2.12.1 release. The fix commit 3e8fa3beea4 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) was included in the upstream release that TuxCare onboarded, as verified by ancestry analysis showing the fix predates the first TuxCare commit (5b8bc0e8de6 \"setup 2.12.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource, which could enable deserialization gadget attacks. The target repository at version 2.12.1-tuxcare.3 is NOT AFFECTED because the fix (adding these classes to the SubTypeValidator blocklist) was already present in the upstream 2.12.1 release. The fix commit 3e8fa3beea4 by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) was included in the upstream release that TuxCare onboarded, as verified by ancestry analysis showing the fix predates the first TuxCare commit (5b8bc0e8de6 \"setup 2.12.1\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:50:08.266665+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.12.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36188. The vulnerability involves unsafe deserialization of two newrelic-agent gadget classes (JNDIConnectionSource and DriverManagerConnectionSource) that can lead to remote code execution via JNDI injection. The upstream vendor (FasterXML) fixed this in version 2.9.10.8 by adding these class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix (commit 33d96c13fe by Tatu Saloranta) was already present in the upstream release when TuxCare onboarded version 2.12.1. The blocklist is enforced during deserialization via SubTypeValidator.validateSubType(), which is called from BeanDeserializerFactory.createBeanDeserializer() and throws JsonMappingException when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "The target jackson-databind 2.12.1-tuxcare.3 is NOT AFFECTED by CVE-2020-36188. The vulnerability involves unsafe deserialization of two newrelic-agent gadget classes (JNDIConnectionSource and DriverManagerConnectionSource) that can lead to remote code execution via JNDI injection. The upstream vendor (FasterXML) fixed this in version 2.9.10.8 by adding these class names to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. The fix (commit 33d96c13fe by Tatu Saloranta) was already present in the upstream release when TuxCare onboarded version 2.12.1. The blocklist is enforced during deserialization via SubTypeValidator.validateSubType(), which is called from BeanDeserializerFactory.createBeanDeserializer() and throws JsonMappingException when blocked classes are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not applicable to jackson-databind 2.12.1-tuxcare.3. The upstream fix (commit 33d96c13fe by Tatu Saloranta, 2020-12-26) was already included in the upstream 2.12.1 release (2021-01-08) that TuxCare onboarded. The vulnerable gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blacklisted in SubTypeValidator.java lines 223-224, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is not applicable to jackson-databind 2.12.1-tuxcare.3. The upstream fix (commit 33d96c13fe by Tatu Saloranta, 2020-12-26) was already included in the upstream 2.12.1 release (2021-01-08) that TuxCare onboarded. The vulnerable gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) are blacklisted in SubTypeValidator.java lines 223-224, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:10:12.627525+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions lacking JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.12.1 is not affected because the upstream fix (commit 914e7c9f, first released in 2.8.11.5 on Feb 9, 2020) was already present in the upstream 2.12.1 release that TuxCare onboarded. The blocklist entry blocking JndiConverter deserialization is present at SubTypeValidator.java:138.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 affects jackson-databind versions lacking JNDI blocking for org.apache.xbean.propertyeditor.JndiConverter. The target version 2.12.1 is not affected because the upstream fix (commit 914e7c9f, first released in 2.8.11.5 on Feb 9, 2020) was already present in the upstream 2.12.1 release that TuxCare onboarded. The blocklist entry blocking JndiConverter deserialization is present at SubTypeValidator.java:138.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 concerns deserialization gadgets in jackson-databind before 2.9.10.4, specifically org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.12.1-tuxcare.3 contains the upstream fix that blocks this gadget class in SubTypeValidator.java:141. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.10.4+, which predates the 2.12.1 release that TuxCare onboarded. The vulnerable deserialization pattern is not present because the blocklist defense was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 concerns deserialization gadgets in jackson-databind before 2.9.10.4, specifically org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.12.1-tuxcare.3 contains the upstream fix that blocks this gadget class in SubTypeValidator.java:141. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.10.4+, which predates the 2.12.1 release that TuxCare onboarded. The vulnerable deserialization pattern is not present because the blocklist defense was already included in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:17.536969+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability concerns a deserialization gadget class (com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig) that should be blocked. The upstream fix (commit 9f4e97019f by Tatu Saloranta) added this class to the SubTypeValidator blocklist and was already present in the upstream 2.12.1 release before TuxCare onboarded it. The gadget class is confirmed blocked at SubTypeValidator.java:144.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is not present in jackson-databind 2.12.1-tuxcare.3. The vulnerability concerns a deserialization gadget class (com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig) that should be blocked. The upstream fix (commit 9f4e97019f by Tatu Saloranta) added this class to the SubTypeValidator blocklist and was already present in the upstream 2.12.1 release before TuxCare onboarded it. The gadget class is confirmed blocked at SubTypeValidator.java:144.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:14:34.572852+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 concerns a deserialization gadget vulnerability in jackson-databind related to br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.12.1-tuxcare.3) is NOT affected because the upstream vendor fix was already present in the base release 2.12.1 that TuxCare onboarded. The fix (commit 1e64db6a2f by upstream maintainer Tatu Saloranta, dated Feb 29, 2020) adds AnterosDBCPConfig to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix is an ancestor of the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\"), confirming it shipped in the upstream release rather than being backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 concerns a deserialization gadget vulnerability in jackson-databind related to br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.12.1-tuxcare.3) is NOT affected because the upstream vendor fix was already present in the base release 2.12.1 that TuxCare onboarded. The fix (commit 1e64db6a2f by upstream maintainer Tatu Saloranta, dated Feb 29, 2020) adds AnterosDBCPConfig to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix is an ancestor of the first TuxCare commit (5b8bc0e8de \"setup 2.12.1\"), confirming it shipped in the upstream release rather than being backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:30.450582+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.12.1-tuxcare.3. The fix blocking javax.swing.JTextPane gadget deserialization (upstream commit 7dbf51bf by Tatu Saloranta) was already included in the upstream 2.12.1 release that TuxCare onboarded. The dangerous class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java:151) and validateSubType() prevents its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.12.1-tuxcare.3. The fix blocking javax.swing.JTextPane gadget deserialization (upstream commit 7dbf51bf by Tatu Saloranta) was already included in the upstream 2.12.1 release that TuxCare onboarded. The dangerous class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist (SubTypeValidator.java:151) and validateSubType() prevents its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      },
      "action_statement": "Vulnerability CVE-2026-19032 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.12.1 is not vulnerable. Summary: The target repository (jackson-databind 2.12.1-tuxcare.1) is NOT VULNERABLE to CVE-2026-50193. The vulnerable code pattern described in the CVE was never present in version 2.12.1. The vulnerability was introduced during 2.14.0 development (commit d2ba1ada80 on May 3, 2022) and fixed one day later (commit a1fa4ae4ec on May 4, 2022) before the 2.14.0 release. Version 2.12.1 uses a simple, non-recursive serialization mechanism via STD_WRITER.writeValueAsString() that does not suffer from stack overflow with deeply nested JSON.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "Version 2.12.1 is not vulnerable. Summary: The target repository (jackson-databind 2.12.1-tuxcare.1) is NOT VULNERABLE to CVE-2026-50193. The vulnerable code pattern described in the CVE was never present in version 2.12.1. The vulnerability was introduced during 2.14.0 development (commit d2ba1ada80 on May 3, 2022) and fixed one day later (commit a1fa4ae4ec on May 4, 2022) before the 2.14.0 release. Version 2.12.1 uses a simple, non-recursive serialization mechanism via STD_WRITER.writeValueAsString() that does not suffer from stack overflow with deeply nested JSON."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "action_statement": "Vulnerability CVE-2026-54514 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "action_statement": "Vulnerability CVE-2026-54515 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:02:08.959176+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.12.1 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires @JsonUnwrapped on creator parameters combined with @JsonView, but this feature combination is explicitly NOT SUPPORTED in version 2.12.1. The code actively rejects unwrapped creator parameters with error \"combination not yet supported\" (BeanDeserializerBase.java:917-923, databind#265). The vulnerable method proc...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Target version 2.12.1 is NOT AFFECTED by CVE-2026-54518. The vulnerability requires @JsonUnwrapped on creator parameters combined with @JsonView, but this feature combination is explicitly NOT SUPPORTED in version 2.12.1. The code actively rejects unwrapped creator parameters with error \"combination not yet supported\" (BeanDeserializerBase.java:917-923, databind#265). The vulnerable method proc..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T11:06:52.553662+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      },
      "action_statement": "Vulnerability CVE-2026-59889 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:35:56.126653+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:35:56.126653+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:35:56.126653+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:36:00.601340+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:36:00.601340+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:27:00.106913+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      },
      "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.12.1-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.12.1-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}