{
  "@id": "urn:uuid:408de175-6c7a-477c-a937-d9bd36ed14fa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 86,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T21:17:40.330962+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.13.3. The vulnerability affected versions prior to 2.8.11 and 2.9.4, and the target version 2.13.3 includes the upstream fix. The SubTypeValidator contains the complete blacklist of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, org.springframework.beans.factory.config.PropertyPathFactoryBean, and C3P0 DataSource classes), preventing deserialization-based code execution attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.13.3. The vulnerability affected versions prior to 2.8.11 and 2.9.4, and the target version 2.13.3 includes the upstream fix. The SubTypeValidator contains the complete blacklist of dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, org.springframework.beans.factory.config.PropertyPathFactoryBean, and C3P0 DataSource classes), preventing deserialization-based code execution attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:17.536969+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.13.3-tuxcare.2 is not affected by CVE-2017-17485. The CVE affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3, with fixes released in 2.8.11 (Dec 2017) and 2.9.4 (Jan 2018). The target version 2.13.3 (May 2022) is 4.5 years newer and already contains all the upstream fixes: blacklist entries for FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, BCEL ClassLoader, and pattern-based blocking for Spring and C3P0 gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "Target version 2.13.3-tuxcare.2 is not affected by CVE-2017-17485. The CVE affects jackson-databind through 2.8.10 and 2.9.x through 2.9.3, with fixes released in 2.8.11 (Dec 2017) and 2.9.4 (Jan 2018). The target version 2.13.3 (May 2022) is 4.5 years newer and already contains all the upstream fixes: blacklist entries for FileHandler, UnicastRemoteObject, PropertyPathFactoryBean, BasicDataSource, BCEL ClassLoader, and pattern-based blocking for Spring and C3P0 gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:24:51.161829+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 (Jackson deserialization gadget class RCE) is NOT present in jackson-databind 2.13.3. The vulnerability was fixed by upstream maintainer Tatu Saloranta in 2017 and shipped in the upstream 2.13.3 release that TuxCare onboarded. The target contains SubTypeValidator with a comprehensive blocklist of dangerous gadget classes including all classes from the original CVE-2017-7525 patches plus many more added in subsequent security updates.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 (Jackson deserialization gadget class RCE) is NOT present in jackson-databind 2.13.3. The vulnerability was fixed by upstream maintainer Tatu Saloranta in 2017 and shipped in the upstream 2.13.3 release that TuxCare onboarded. The target contains SubTypeValidator with a comprehensive blocklist of dangerous gadget classes including all classes from the original CVE-2017-7525 patches plus many more added in subsequent security updates.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.3 is NOT affected by CVE-2018-11307. The vulnerability involves deserialization of org.apache.ibatis.parsing.XPathParser with Jackson default typing to enable data exfiltration via XML external entities. The fix (blacklist entry blocking XPathParser) was added in upstream commit 27b4defc270454dea6842bd9279f17387eceb737 by Tatu Saloranta (FasterXML maintainer), which was already included in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "The target jackson-databind 2.13.3 is NOT affected by CVE-2018-11307. The vulnerability involves deserialization of org.apache.ibatis.parsing.XPathParser with Jackson default typing to enable data exfiltration via XML external entities. The fix (blacklist entry blocking XPathParser) was added in upstream commit 27b4defc270454dea6842bd9279f17387eceb737 by Tatu Saloranta (FasterXML maintainer), which was already included in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable pattern is not present in the target because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:14:51.865228+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 when Default Typing is enabled and Jodd-db is in the classpath. The vulnerability allows remote code execution via malicious JNDI/LDAP gadget deserialization. The target (jackson-databind 2.13.3-tuxcare.2) already contains the upstream vendor fix - the Jodd-db class \"jodd.db.connection.DataSourceConnectionProvider\" and related Oracle JDBC gadget classes are present in the deserialization blacklist (SubTypeValidator.java lines 68, 71-72). The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a and shipped in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 when Default Typing is enabled and Jodd-db is in the classpath. The vulnerability allows remote code execution via malicious JNDI/LDAP gadget deserialization. The target (jackson-databind 2.13.3-tuxcare.2) already contains the upstream vendor fix - the Jodd-db class \"jodd.db.connection.DataSourceConnectionProvider\" and related Oracle JDBC gadget classes are present in the deserialization blacklist (SubTypeValidator.java lines 68, 71-72). The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) in commit 28badf7ef60ac3e7ef151cd8e8ec010b8479226a and shipped in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:04.637381+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.13.3-tuxcare.2 is significantly newer and already includes the upstream fix that blocks polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet). The fix was committed upstream by tatu.saloranta@iki.fi on 2018-05-31 and was included in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. The target version 2.13.3-tuxcare.2 is significantly newer and already includes the upstream fix that blocks polymorphic deserialization of Oracle JDBC driver classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet). The fix was committed upstream by tatu.saloranta@iki.fi on 2018-05-31 and was included in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:40:32.377029+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED by CVE-2018-14718. The upstream fix (commit 87d29af25e) that blocks org.slf4j.ext.EventData from polymorphic deserialization was already included in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The dangerous class is present in the blocklist at SubTypeValidator.java:75 and actively enforced during deserialization. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target version jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED by CVE-2018-14718. The upstream fix (commit 87d29af25e) that blocks org.slf4j.ext.EventData from polymorphic deserialization was already included in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The dangerous class is present in the blocklist at SubTypeValidator.java:75 and actively enforced during deserialization. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:56:28.365878+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for BlazeDS classes (flex.messaging.*) that enable polymorphic deserialization attacks. The target repository at version 2.13.3-tuxcare.2 is NOT AFFECTED because the upstream fix (commit 87d29af25e) was already present in the jackson-databind 2.13.3 release that TuxCare onboarded. The SubTypeValidator.java file contains the complete blocklist including \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" at line 76, which blocks the dangerous BlazeDS class from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 due to missing blocklist entries for BlazeDS classes (flex.messaging.*) that enable polymorphic deserialization attacks. The target repository at version 2.13.3-tuxcare.2 is NOT AFFECTED because the upstream fix (commit 87d29af25e) was already present in the jackson-databind 2.13.3 release that TuxCare onboarded. The SubTypeValidator.java file contains the complete blocklist including \"flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor\" at line 76, which blocks the dangerous BlazeDS class from deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:03:22.406684+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.13.3. The vulnerability allowed XXE attacks via polymorphic deserialization of four specific JDK/3rd-party classes. The upstream fix (commit 87d29af25e by Tatu Saloranta, 2018-08-16) added these classes to a deserialization blocklist. This fix was already included in upstream version 2.13.3 when TuxCare onboarded it. The blocklist is actively enforced in SubTypeValidator.java:75-78, preventing instantiation of the malicious classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.13.3. The vulnerability allowed XXE attacks via polymorphic deserialization of four specific JDK/3rd-party classes. The upstream fix (commit 87d29af25e by Tatu Saloranta, 2018-08-16) added these classes to a deserialization blocklist. This fix was already included in upstream version 2.13.3 when TuxCare onboarded it. The blocklist is actively enforced in SubTypeValidator.java:75-78, preventing instantiation of the malicious classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:31:59.864465+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, enabling SSRF via polymorphic deserialization. The target (version 2.13.3-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 87d29af25e by tatu.saloranta@iki.fi) was already present in the upstream 2.13.3 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:78 and is enforced unconditionally at BeanDeserializerFactory.java:999, blocking deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, enabling SSRF via polymorphic deserialization. The target (version 2.13.3-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 87d29af25e by tatu.saloranta@iki.fi) was already present in the upstream 2.13.3 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:78 and is enforced unconditionally at BeanDeserializerFactory.java:999, blocking deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to the ability to deserialize the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The target version 2.13.3-tuxcare.1 already contains the upstream fix (commit 72cd4025a \"Fix #2186\" by Tatu Saloranta) which was part of the upstream 2.13.3 release. The fix adds org.apache.axis2.transport.jms.JMSOutTransportInfo to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 85), preventing polymorphic deserialization of this class. The blocklist is enforced during deserialization via SubTypeValidator.validateSubType() called from BeanDeserializerFactory. Since the fix was already in the upstream release that TuxCare onboarded (before first TuxCare commit 322db7630d), the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to the ability to deserialize the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The target version 2.13.3-tuxcare.1 already contains the upstream fix (commit 72cd4025a \"Fix #2186\" by Tatu Saloranta) which was part of the upstream 2.13.3 release. The fix adds org.apache.axis2.transport.jms.JMSOutTransportInfo to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 85), preventing polymorphic deserialization of this class. The blocklist is enforced during deserialization via SubTypeValidator.validateSubType() called from BeanDeserializerFactory. Since the fix was already in the upstream release that TuxCare onboarded (before first TuxCare commit 322db7630d), the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:53:33.389442+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability concerns the failure to block openjpa classes (specifically org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. The target repository already contains the upstream fix: these class names are present in the blocklist at SubTypeValidator.java lines 82-83. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the jackson-databind 2.13.3 release that TuxCare onboarded, prior to any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability concerns the failure to block openjpa classes (specifically org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) from polymorphic deserialization. The target repository already contains the upstream fix: these class names are present in the blocklist at SubTypeValidator.java lines 82-83. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the jackson-databind 2.13.3 release that TuxCare onboarded, prior to any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:23:04.955983+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream 2.13.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (322db7630d \"Onboard version 2.13.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream 2.13.3 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (322db7630d \"Onboard version 2.13.3\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 exploits two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to achieve remote code execution in jackson-databind \u22642.8.11 and 2.9.x through 2.9.3. The target (jackson-databind 2.13.3-tuxcare.2) already contains the fix: both gadget classes are blacklisted in SubTypeValidator.java lines 62-63. This fix was authored by upstream maintainer Tatu Saloranta in commit 038b471e2e (January 2018) and shipped in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 exploits two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to achieve remote code execution in jackson-databind \u22642.8.11 and 2.9.x through 2.9.3. The target (jackson-databind 2.13.3-tuxcare.2) already contains the fix: both gadget classes are blacklisted in SubTypeValidator.java lines 62-63. This fix was authored by upstream maintainer Tatu Saloranta in commit 038b471e2e (January 2018) and shipped in the upstream 2.13.3 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.13.3-tuxcare.2. The upstream fix (commit 6799f8f10c \"Fix #1931\" by Tatu Saloranta) shipped in the base 2.13.3 release, blocking deserialization of c3p0 DataSource classes matching pattern \"com.mchange.v2.c3p0.*DataSource\". The vulnerable pattern described in the CVE does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.13.3-tuxcare.2. The upstream fix (commit 6799f8f10c \"Fix #1931\" by Tatu Saloranta) shipped in the base 2.13.3 release, blocking deserialization of c3p0 DataSource classes matching pattern \"com.mchange.v2.c3p0.*DataSource\". The vulnerable pattern described in the CVE does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:28:57.615729+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is a polymorphic typing vulnerability in jackson-databind versions before 2.9.9 that allows arbitrary file read via deserialization of the com.mysql.cj.jdbc.admin.MiniAdmin gadget class when Default Typing is enabled. The target repository (jackson-databind 2.13.3-tuxcare.2) is NOT AFFECTED because the upstream fix was already present in version 2.13.3 when TuxCare onboarded it. The fix adds MiniAdmin to a deserialization blacklist (SubTypeValidator.java line 88), preventing instantiation of this class. The fix commit (dda513bd72) was authored by upstream maintainer Tatu Saloranta on 2019-05-14 for version 2.9.9, and is an ancestor of the first TuxCare onboarding commit (322db7630d). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is a polymorphic typing vulnerability in jackson-databind versions before 2.9.9 that allows arbitrary file read via deserialization of the com.mysql.cj.jdbc.admin.MiniAdmin gadget class when Default Typing is enabled. The target repository (jackson-databind 2.13.3-tuxcare.2) is NOT AFFECTED because the upstream fix was already present in version 2.13.3 when TuxCare onboarded it. The fix adds MiniAdmin to a deserialization blacklist (SubTypeValidator.java line 88), preventing instantiation of this class. The fix commit (dda513bd72) was authored by upstream maintainer Tatu Saloranta on 2019-05-14 for version 2.9.9, and is an ancestor of the first TuxCare onboarding commit (322db7630d). The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T18:24:00.114332+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT affecting this target. The fix commit c9ef4a10d6f6633cf470d6a469514b68fa2be234, which adds ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist, was authored by upstream maintainer Tatu Saloranta and was already present in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT affecting this target. The fix commit c9ef4a10d6f6633cf470d6a469514b68fa2be234, which adds ch.qos.logback.core.db.DriverManagerConnectionSource to the deserialization blocklist, was authored by upstream maintainer Tatu Saloranta and was already present in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:06:00.125315+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability allowed arbitrary file reads via JDOM XSLTransformer deserialization when Default Typing was enabled. The upstream fix (commit 5f7c69bba0, June 2019) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was already pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability allowed arbitrary file reads via JDOM XSLTransformer deserialization when Default Typing was enabled. The upstream fix (commit 5f7c69bba0, June 2019) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was already pr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.13.3-tuxcare.1. The vulnerability involves unsafe deserialization of the ehcache class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream fix (commit ad418eeb97) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.13.3 release that TuxCare onboarded (commit 322db7630d), as confirmed by git ancestry analysis. The target's SubTypeValidator.java contains the ehcache class in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 98, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.13.3-tuxcare.1. The vulnerability involves unsafe deserialization of the ehcache class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream fix (commit ad418eeb97) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.13.3 release that TuxCare onboarded (commit 322db7630d), as confirmed by git ancestry analysis. The target's SubTypeValidator.java contains the ehcache class in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 98, blocking the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:28:16.907403+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.13.3. The vulnerability involved polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource enabling JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 by adding the dangerous class to the SubTypeValidator blacklist. This fix was already present in upstream release 2.13.3 when TuxCare onboarded it (first TuxCare commit: 322db7630d \"Onboard version 2.13.3\"). The blacklist entry exists at SubTypeValidator.java:102 and blocks deserialization during polymorphic type validation, preventing the attack chain from reaching the JNDI injection goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.13.3. The vulnerability involved polymorphic deserialization of ch.qos.logback.core.db.JNDIConnectionSource enabling JNDI injection attacks. The upstream vendor (FasterXML) fixed this in commit ad418eeb97 by adding the dangerous class to the SubTypeValidator blacklist. This fix was already present in upstream release 2.13.3 when TuxCare onboarded it (first TuxCare commit: 322db7630d \"Onboard version 2.13.3\"). The blacklist entry exists at SubTypeValidator.java:102 and blocks deserialization during polymorphic type validation, preventing the attack chain from reaching the JNDI injection goal.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:48.744845+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is a polymorphic typing vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.13.3-tuxcare.2) is NOT affected because the upstream vendor fix was already included in the upstream release 2.10.0 and all subsequent versions including 2.13.3. The fix adds HikariConfig and HikariDataSource to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.13.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is a polymorphic typing vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.13.3-tuxcare.2) is NOT affected because the upstream vendor fix was already included in the upstream release 2.10.0 and all subsequent versions including 2.13.3. The fix adds HikariConfig and HikariDataSource to SubTypeValidator's blocklist, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded version 2.13.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:52:11.742351+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration 1 and 2 JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to achieve arbitrary code execution. The fix was implemented upstream by Tatu Saloranta in commit 41b7f9b901 (September 19, 2019), which added these two class names to the SubTypeValidator blocklist. This fix was already present in the upstream 2.13.3 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration 1 and 2 JNDI classes (org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) to achieve arbitrary code execution. The fix was implemented upstream by Tatu Saloranta in commit 41b7f9b901 (September 19, 2019), which added these two class names to the SubTypeValidator blocklist. This fix was already present in the upstream 2.13.3 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0. The target is version 2.13.3-tuxcare.2, which already contains the upstream fix applied in September 2019. The dangerous class org.apache.xalan.lib.sql.JNDIConnectionPool is blacklisted in SubTypeValidator.java (line 117), along with 4 additional xalan variants, preventing polymorphic deserialization exploitation. This is an upstream fix that shipped with version 2.13.3 in May 2022, predating TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0. The target is version 2.13.3-tuxcare.2, which already contains the upstream fix applied in September 2019. The dangerous class org.apache.xalan.lib.sql.JNDIConnectionPool is blacklisted in SubTypeValidator.java (line 117), along with 4 additional xalan variants, preventing polymorphic deserialization exploitation. This is an upstream fix that shipped with version 2.13.3 in May 2022, predating TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:04.850496+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.3-tuxcare.2 is NOT vulnerable to CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to remote code execution. The upstream fix (adding HikariDataSource to the blocklist in SubTypeValidator.java) was applied by upstream maintainer Tatu Saloranta in commit 73c1c2cc76e on 2019-09-12 and shipped in the upstream 2.13.3 release before TuxCare onboarded the project. The target version is well above the affected version threshold (2.9.10), and the fix is present at line 107 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "The target jackson-databind version 2.13.3-tuxcare.2 is NOT vulnerable to CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to remote code execution. The upstream fix (adding HikariDataSource to the blocklist in SubTypeValidator.java) was applied by upstream maintainer Tatu Saloranta in commit 73c1c2cc76e on 2019-09-12 and shipped in the upstream 2.13.3 release before TuxCare onboarded the project. The target version is well above the affected version threshold (2.9.10), and the fix is present at line 107 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:00:13.288450+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.13.3. The vulnerability affects versions 2.0.0-2.9.10, allowing polymorphic deserialization of commons-dbcp/p6spy gadget classes to trigger JNDI-based RCE. The fix (adding three class names to SubTypeValidator's deserialization blocklist) was committed by upstream author Tatu Saloranta in Sept 2019 (commits 9593e16, 328a0f8) and shipped in upstream jackson-databind 2.13.3 released March 2022. TuxCare onboarded this version in commit 322db763, inheriting the fix. All three gadget classes are blocked at SubTypeValidator.java:124-127, preventing their instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.13.3. The vulnerability affects versions 2.0.0-2.9.10, allowing polymorphic deserialization of commons-dbcp/p6spy gadget classes to trigger JNDI-based RCE. The fix (adding three class names to SubTypeValidator's deserialization blocklist) was committed by upstream author Tatu Saloranta in Sept 2019 (commits 9593e16, 328a0f8) and shipped in upstream jackson-databind 2.13.3 released March 2022. TuxCare onboarded this version in commit 322db763, inheriting the fix. All three gadget classes are blocked at SubTypeValidator.java:124-127, preventing their instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:11:43.788711+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability (polymorphic deserialization of p6spy and commons-dbcp gadget classes) was fixed by upstream commits 9593e16cf5a (2019-09-28) and 328a0f833da (2019-09-28), both authored by Tatu Saloranta. These fixes were included in the upstream 2.13.3 release, which TuxCare onboarded via commit 322db7630dc. The target contains all three required blocklist entries (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource) in SubTypeValidator.java lines 124-127, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability (polymorphic deserialization of p6spy and commons-dbcp gadget classes) was fixed by upstream commits 9593e16cf5a (2019-09-28) and 328a0f833da (2019-09-28), both authored by Tatu Saloranta. These fixes were included in the upstream 2.13.3 release, which TuxCare onboarded via commit 322db7630dc. The target contains all three required blocklist entries (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, SharedPoolDataSource) in SubTypeValidator.java lines 124-127, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:10.977883+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream vendor (FasterXML) added this class to the deserialization blocklist in commit 191a4cdf87 (issue #2460), which shipped in the upstream 2.13.3 release. TuxCare onboarded version 2.13.3 with this fix already present. The target code at SubTypeValidator.java:99 contains the blocklist entry that prevents deserialization of this gadget class, and the validation logic at lines 269-303 enforces the blocklist during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves polymorphic deserialization of the dangerous gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream vendor (FasterXML) added this class to the deserialization blocklist in commit 191a4cdf87 (issue #2460), which shipped in the upstream 2.13.3 release. TuxCare onboarded version 2.13.3 with this fix already present. The target code at SubTypeValidator.java:99 contains the blocklist entry that prevents deserialization of this gadget class, and the validation logic at lines 269-303 enforces the blocklist during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:44:46.412412+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.3-tuxcare.2 is not affected by CVE-2019-17531. The vulnerability was fixed in upstream commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 (Fix #2498) by Tatu Saloranta, which was already included in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The fix adds two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 129-131), preventing their deserialization and blocking the JNDI-based remote code execution attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "The target jackson-databind version 2.13.3-tuxcare.2 is not affected by CVE-2019-17531. The vulnerability was fixed in upstream commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 (Fix #2498) by Tatu Saloranta, which was already included in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The fix adds two log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 129-131), preventing their deserialization and blocking the JNDI-based remote code execution attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target is not affected by CVE-2019-20330. The vulnerability requires the absence of blocklist entries for two ehcache classes (GenericJndiSelector, GlassfishSelector) that enable JNDI injection during polymorphic deserialization. The target version 2.13.3 already contains these blocklist entries in SubTypeValidator.java (lines 134-135) because they were added by upstream FasterXML maintainer Tatu Saloranta in commits eb254813cc and fc4214a883, which were included in the upstream release before TuxCare onboarded version 2.13.3. The vulnerable code pattern (missing blocklist) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target is not affected by CVE-2019-20330. The vulnerability requires the absence of blocklist entries for two ehcache classes (GenericJndiSelector, GlassfishSelector) that enable JNDI injection during polymorphic deserialization. The target version 2.13.3 already contains these blocklist entries in SubTypeValidator.java (lines 134-135) because they were added by upstream FasterXML maintainer Tatu Saloranta in commits eb254813cc and fc4214a883, which were included in the upstream release before TuxCare onboarded version 2.13.3. The vulnerable code pattern (missing blocklist) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:58:10.565756+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.13.3-tuxcare.2) is NOT affected by CVE-2020-10650. The upstream fix for this vulnerability (commit a424c038ba) was already present in the upstream 2.13.3 release that TuxCare onboarded. The fix adds three dangerous class names to the SubTypeValidator blocklist (lines 157-160): org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This blocklist prevents polymorphic deserialization of these classes, which could otherwise be exploited for arbitrary code execution via JNDI injection gadgets. The defense mechanism is active and enforced in validateSubType() (line 269) which throws a JsonMappingException when any blocklisted class is detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind 2.13.3-tuxcare.2) is NOT affected by CVE-2020-10650. The upstream fix for this vulnerability (commit a424c038ba) was already present in the upstream 2.13.3 release that TuxCare onboarded. The fix adds three dangerous class names to the SubTypeValidator blocklist (lines 157-160): org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. This blocklist prevents polymorphic deserialization of these classes, which could otherwise be exploited for arbitrary code execution via JNDI injection gadgets. The defense mechanism is active and enforced in validateSubType() (line 269) which throws a JsonMappingException when any blocklisted class is detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 is NOT affecting this target. The vulnerability concerns deserialization of the gadget class `org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory` in jackson-databind versions before 2.9.10.4. The target version 2.13.3-tuxcare.2 contains the upstream fix that blocks this gadget class in SubTypeValidator.java (lines 162-164). The fix was authored by upstream FasterXML maintainers (commits 592872f423 and 08fbfacf89) and was already present in the upstream 2.13.3 release before TuxCare onboarded it (first TuxCare commit: 322db7630d \"Onboard version 2.13.3\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 is NOT affecting this target. The vulnerability concerns deserialization of the gadget class `org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory` in jackson-databind versions before 2.9.10.4. The target version 2.13.3-tuxcare.2 contains the upstream fix that blocks this gadget class in SubTypeValidator.java (lines 162-164). The fix was authored by upstream FasterXML maintainers (commits 592872f423 and 08fbfacf89) and was already present in the upstream 2.13.3 release before TuxCare onboarded it (first TuxCare commit: 322db7630d \"Onboard version 2.13.3\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:22:58.856963+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves unsafe deserialization of the com.caucho.config.types.ResourceRef gadget class. The upstream fix (commit 1645efbd39, March 2020) added ResourceRef to the deny-list in SubTypeValidator.java, preventing its polymorphic deserialization. This fix was already present in upstream jackson-databind 2.13.3 when TuxCare onboarded it in August 2026. The vulnerable pattern has been removed by the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves unsafe deserialization of the com.caucho.config.types.ResourceRef gadget class. The upstream fix (commit 1645efbd39, March 2020) added ResourceRef to the deny-list in SubTypeValidator.java, preventing its polymorphic deserialization. This fix was already present in upstream jackson-databind 2.13.3 when TuxCare onboarded it in August 2026. The vulnerable pattern has been removed by the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository is jackson-databind version 2.13.3-tuxcare.2. The fix for this CVE (adding the dangerous class to a blocklist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.13.3 release. The vulnerable code pattern is not present in this version because the upstream vendor (FasterXML) included the fix in commit 05d7e0e13f before TuxCare onboarded version 2.13.3. Lines 170-171 of SubTypeValidator.java contain the blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider, which prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target repository is jackson-databind version 2.13.3-tuxcare.2. The fix for this CVE (adding the dangerous class to a blocklist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.13.3 release. The vulnerable code pattern is not present in this version because the upstream vendor (FasterXML) included the fix in commit 05d7e0e13f before TuxCare onboarded version 2.13.3. Lines 170-171 of SubTypeValidator.java contain the blocklist entries for org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider, which prevent deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability, which allowed arbitrary code execution via deserialization gadget chains using javax.swing.JEditorPane, was fixed in the upstream release before TuxCare onboarded version 2.13.3. The fix adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 149-151), preventing this class from being deserialized when polymorphic type handling is enabled. The upstream fix commit (6ba48457984943df0de92c54144f7dcae01b1221 by Tatu Saloranta) is an ancestor of HEAD and predates the first TuxCare commit, confirming it was included in the upstream 2.13.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability, which allowed arbitrary code execution via deserialization gadget chains using javax.swing.JEditorPane, was fixed in the upstream release before TuxCare onboarded version 2.13.3. The fix adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 149-151), preventing this class from being deserialized when polymorphic type handling is enabled. The upstream fix commit (6ba48457984943df0de92c54144f7dcae01b1221 by Tatu Saloranta) is an ancestor of HEAD and predates the first TuxCare commit, confirming it was included in the upstream 2.13.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.3-tuxcare.2 is not affected by CVE-2020-11111. The vulnerability pattern (missing blacklist entries for org.apache.activemq.* deserialization gadget classes) is not present because the upstream fix was already included in the 2.13.3 release that TuxCare onboarded. All nine activemq classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 173-183), blocking their deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit c14c9f99ed (March 26, 2020) and shipped in upstream 2.13.3, which predates the first TuxCare commit (onboarding commit 322db7630d).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "Target jackson-databind 2.13.3-tuxcare.2 is not affected by CVE-2020-11111. The vulnerability pattern (missing blacklist entries for org.apache.activemq.* deserialization gadget classes) is not present because the upstream fix was already included in the 2.13.3 release that TuxCare onboarded. All nine activemq classes are present in the DEFAULT_NO_DESER_CLASS_NAMES blacklist (SubTypeValidator.java lines 173-183), blocking their deserialization. The fix was authored by upstream maintainer Tatu Saloranta in commit c14c9f99ed (March 26, 2020) and shipped in upstream 2.13.3, which predates the first TuxCare commit (onboarding commit 322db7630d).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 by allowing deserialization of the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class. The target repository (version 2.13.3-tuxcare.2) already contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta) which adds RmiProvider to the SubTypeValidator blocklist. This fix was shipped in the upstream release 2.13.3 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 by allowing deserialization of the org.apache.commons.proxy.provider.remoting.RmiProvider gadget class. The target repository (version 2.13.3-tuxcare.2) already contains the upstream fix (commit 05d7e0e13f by Tatu Saloranta) which adds RmiProvider to the SubTypeValidator blocklist. This fix was shipped in the upstream release 2.13.3 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime that could lead to arbitrary code execution. The fix (adding WASRegistryManagedRuntime to the SubTypeValidator blocklist) was already present in upstream jackson-databind 2.13.3 before TuxCare onboarded it. The target version 2.13.3 is well above the CVE's affected range (before 2.9.10.4), and the blocklist entry remains intact at SubTypeValidator.java:84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime that could lead to arbitrary code execution. The fix (adding WASRegistryManagedRuntime to the SubTypeValidator blocklist) was already present in upstream jackson-databind 2.13.3 before TuxCare onboarded it. The target version 2.13.3 is well above the CVE's affected range (before 2.9.10.4), and the blocklist entry remains intact at SubTypeValidator.java:84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4, involving deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The target repository is jackson-databind 2.13.3-tuxcare.2. The upstream fix (commit 113e89fb08) was authored by Tatu Saloranta and included in upstream version 2.10.4 (April 2020), well before the 2.13.3 release (May 2022). The fix adds both Spring Framework classes to SubTypeValidator's blocklist at lines 52-54, preventing their deserialization. Since this fix was already present in the upstream 2.13.3 release that TuxCare onboarded, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4, involving deserialization gadgets org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The target repository is jackson-databind 2.13.3-tuxcare.2. The upstream fix (commit 113e89fb08) was authored by Tatu Saloranta and included in upstream version 2.10.4 (April 2020), well before the 2.13.3 release (May 2022). The fix adds both Spring Framework classes to SubTypeValidator's blocklist at lines 52-54, preventing their deserialization. Since this fix was already present in the upstream 2.13.3 release that TuxCare onboarded, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 does not affect jackson-databind 2.13.3-tuxcare.2. The fix (blacklist entry for org.apache.commons.jelly.impl.Embedded in SubTypeValidator) was already present in the upstream 2.13.3 release when TuxCare onboarded it. The blacklist entry at line 189 prevents deserialization of this gadget class and is actively enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 does not affect jackson-databind 2.13.3-tuxcare.2. The fix (blacklist entry for org.apache.commons.jelly.impl.Embedded in SubTypeValidator) was already present in the upstream 2.13.3 release when TuxCare onboarded it. The blacklist entry at line 189 prevents deserialization of this gadget class and is actively enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-14060. The vulnerability involves deserialization gadgets (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) that enable remote code execution through JNDI injection. The upstream vendor (FasterXML) fixed this in commit d1c67a039 by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.3 release when TuxCare onboarded it on 2022-05-18 (commit 322db7630d). The CVE affects versions before 2.9.10.5, and version 2.13.3 is well beyond that threshold. The blocklist entry is present at line 192 of SubTypeValidator.java and is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-14060. The vulnerability involves deserialization gadgets (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) that enable remote code execution through JNDI injection. The upstream vendor (FasterXML) fixed this in commit d1c67a039 by adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.3 release when TuxCare onboarded it on 2022-05-18 (commit 322db7630d). The CVE affects versions before 2.9.10.5, and version 2.13.3 is well beyond that threshold. The blocklist entry is present at line 192 of SubTypeValidator.java and is enforced during deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of five oracle.jms.AQjms* classes that can lead to arbitrary code execution. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was released in jackson-databind 2.9.10.5 (April 2020) and was already present in the upstream 2.13.3 release that TuxCare onboarded. The target repository contains the complete defense at lines 197-204 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of five oracle.jms.AQjms* classes that can lead to arbitrary code execution. The upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was released in jackson-databind 2.9.10.5 (April 2020) and was already present in the upstream 2.13.3 release that TuxCare onboarded. The target repository contains the complete defense at lines 197-204 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind 2.x before 2.9.10.5. The target version 2.13.3-tuxcare.2 is significantly newer than the affected range. The fix (blacklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool) is present in SubTypeValidator.java at line 119. This fix was added by upstream commit 840eae2ca81c (author: tatu.saloranta@iki.fi) before TuxCare onboarded version 2.13.3, meaning it was already included in the upstream 2.13.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind 2.x before 2.9.10.5. The target version 2.13.3-tuxcare.2 is significantly newer than the affected range. The fix (blacklist entry for com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool) is present in SubTypeValidator.java at line 119. This fix was added by upstream commit 840eae2ca81c (author: tatu.saloranta@iki.fi) before TuxCare onboarded version 2.13.3, meaning it was already included in the upstream 2.13.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of org.jsecurity.realm.jndi.JndiRealmFactory leading to JNDI injection attacks. The fix (adding this class to the SubTypeValidator blocklist) was already included in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The blocklist entry is present at line 207 of SubTypeValidator.java, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of org.jsecurity.realm.jndi.JndiRealmFactory leading to JNDI injection attacks. The fix (adding this class to the SubTypeValidator blocklist) was already included in the upstream jackson-databind 2.13.3 release that TuxCare onboarded. The blocklist entry is present at line 207 of SubTypeValidator.java, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:12.971148+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget vulnerability involving br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository is running version 2.13.3-tuxcare.2, which already contains the upstream fix. The fix (adding AnterosDBCPDataSource to the SubTypeValidator blacklist) was included in the upstream 2.13.3 release before TuxCare onboarding, making this version not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6 due to a deserialization gadget vulnerability involving br.com.anteros.dbcp.AnterosDBCPDataSource. The target repository is running version 2.13.3-tuxcare.2, which already contains the upstream fix. The fix (adding AnterosDBCPDataSource to the SubTypeValidator blacklist) was included in the upstream 2.13.3 release before TuxCare onboarding, making this version not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:11:26.566722+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED by CVE-2020-24750. The fix blocking deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in the upstream 2.13.3 release that TuxCare onboarded. The dangerous class is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:210, preventing instantiation during polymorphic deserialization. This is an upstream fix (commit 6cc9f1a1af by tatu.saloranta@iki.fi from July 2020), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "The target jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED by CVE-2020-24750. The fix blocking deserialization of com.pastdev.httpcomponents.configuration.JndiConfiguration was already present in the upstream 2.13.3 release that TuxCare onboarded. The dangerous class is in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:210, preventing instantiation during polymorphic deserialization. This is an upstream fix (commit 6cc9f1a1af by tatu.saloranta@iki.fi from July 2020), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in Jackson Databind) is NOT PRESENT in version 2.13.3-tuxcare.2. The upstream fix (commit 612f971b78c60202e9cd75a299050c8f2d724a59, authored by Tatu Saloranta) was already included in the upstream release 2.13.3 before TuxCare onboarded it on 2026-08-03. The fix adds two critical XML parser security features in DOMDeserializer.java: (1) disallow-doctype-decl=true and (2) load-external-dtd=false, which prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in Jackson Databind) is NOT PRESENT in version 2.13.3-tuxcare.2. The upstream fix (commit 612f971b78c60202e9cd75a299050c8f2d724a59, authored by Tatu Saloranta) was already included in the upstream release 2.13.3 before TuxCare onboarded it on 2026-08-03. The fix adds two critical XML parser security features in DOMDeserializer.java: (1) disallow-doctype-decl=true and (2) load-external-dtd=false, which prevent XXE attacks by blocking DOCTYPE declarations and external DTD loading. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:18:54.750507+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind 2.x before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target version 2.13.3-tuxcare.2 (2.13.3 > 2.9.10.8) already contains the upstream fix (commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by tatu.saloranta@iki.fi) that blocklists these gadget classes in SubTypeValidator.java lines 217-218. The fix shipped in upstream jackson-databind 2.13.3 and was present when TuxCare onboarded this version. The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind 2.x before 2.9.10.8 due to deserialization gadgets in org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target version 2.13.3-tuxcare.2 (2.13.3 > 2.9.10.8) already contains the upstream fix (commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by tatu.saloranta@iki.fi) that blocklists these gadget classes in SubTypeValidator.java lines 217-218. The fix shipped in upstream jackson-databind 2.13.3 and was present when TuxCare onboarded this version. The vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:27:39.447287+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.13.3-tuxcare.1. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (adding these classes to the deserialization blacklist in SubTypeValidator.java) was already included in the upstream release 2.9.10.8, which predates version 2.13.3. The fix commit (41b8bdb5cc) was authored by upstream maintainer Tatu Saloranta and is present in the version TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.13.3-tuxcare.1. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (adding these classes to the deserialization blacklist in SubTypeValidator.java) was already included in the upstream release 2.9.10.8, which predates version 2.13.3. The fix commit (41b8bdb5cc) was authored by upstream maintainer Tatu Saloranta and is present in the version TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:52:50.063962+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerable deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) is already blocked by SubTypeValidator at line 240. This fix was shipped in the upstream release 2.13.3, prior to TuxCare onboarding the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerable deserialization gadget class (com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool) is already blocked by SubTypeValidator at line 240. This fix was shipped in the upstream release 2.13.3, prior to TuxCare onboarding the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:20:48.274952+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not affecting this target. The fix for this deserialization gadget vulnerability was already present in upstream jackson-databind 2.13.3, which TuxCare onboarded. All five DriverAdapterCPDS blocklist entries from the upstream patch (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) are present in SubTypeValidator.java. The vulnerable code pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not affecting this target. The fix for this deserialization gadget vulnerability was already present in upstream jackson-databind 2.13.3, which TuxCare onboarded. All five DriverAdapterCPDS blocklist entries from the upstream patch (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) are present in SubTypeValidator.java. The vulnerable code pattern is not present because the upstream fix shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:32:29.747187+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-36180. The vulnerability concerns deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The fix (commit 3ded28aece) that adds these classes to the deserialization blocklist was authored by upstream maintainer Tatu Saloranta on 2020-12-31 and included in upstream release 2.13.0. TuxCare onboarded version 2.13.3 on 2026-08-03, which already contained this upstream fix. The blocklist entries are present and functional in HEAD, preventing deserialization of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-36180. The vulnerability concerns deserialization gadgets using org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related classes. The fix (commit 3ded28aece) that adds these classes to the deserialization blocklist was authored by upstream maintainer Tatu Saloranta on 2020-12-31 and included in upstream release 2.13.0. TuxCare onboarded version 2.13.3 on 2026-08-03, which already contained this upstream fix. The blocklist entries are present and functional in HEAD, preventing deserialization of the dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:39:17.536668+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.13.3-tuxcare.2 is not affected by CVE-2020-36181. The vulnerability pattern (deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS gadget class) is not present because the upstream fix was already included in version 2.13.0, which predates the TuxCare onboarding of version 2.13.3. The dangerous class is blocked in SubTypeValidator.java line 228.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "The target jackson-databind version 2.13.3-tuxcare.2 is not affected by CVE-2020-36181. The vulnerability pattern (deserialization of org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS gadget class) is not present because the upstream fix was already included in version 2.13.0, which predates the TuxCare onboarding of version 2.13.3. The dangerous class is blocked in SubTypeValidator.java line 228.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:29.791973+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS when polymorphic type handling is enabled. The upstream fix (commit 3ded28aece by Tatu Saloranta) added this class to the deserialization blacklist and was already included in the upstream 2.13.3 release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:234 and is actively enforced via the validateSubType() method, which throws an exception when attempting to deserialize blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.13.3-tuxcare.2. The vulnerability relates to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS when polymorphic type handling is enabled. The upstream fix (commit 3ded28aece by Tatu Saloranta) added this class to the deserialization blacklist and was already included in the upstream 2.13.3 release that TuxCare onboarded. The blacklist entry is present at SubTypeValidator.java:234 and is actively enforced via the validateSubType() method, which throws an exception when attempting to deserialize blacklisted classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:19:43.444136+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183: jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED. The vulnerable deserialization gadget class 'org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool' is blocked by a defense that shipped in the upstream 2.13.3 release. The fix (blocklist entry in SubTypeValidator.java:243) was authored by upstream Jackson maintainer Tatu Saloranta on Dec 31, 2020 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29) and was already present when TuxCare onboarded version 2.13.3. The defense is active by default, unconditionally enforced during deserialization, and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183: jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED. The vulnerable deserialization gadget class 'org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool' is blocked by a defense that shipped in the upstream 2.13.3 release. The fix (blocklist entry in SubTypeValidator.java:243) was authored by upstream Jackson maintainer Tatu Saloranta on Dec 31, 2020 (commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29) and was already present when TuxCare onboarded version 2.13.3. The defense is active by default, unconditionally enforced during deserialization, and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.13.3-tuxcare.1. The vulnerability involves deserialization gadgets (org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix, which adds these classes to the SubTypeValidator blocklist, was already included in the upstream jackson-databind 2.13.3 release (May 2022) that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) in December 2020, well before the 2.13.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.13.3-tuxcare.1. The vulnerability involves deserialization gadgets (org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix, which adds these classes to the SubTypeValidator blocklist, was already included in the upstream jackson-databind 2.13.3 release (May 2022) that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) in December 2020, well before the 2.13.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:02:59.383624+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.13.3. The vulnerability involves polymorphic deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource). The upstream fix (commit 567194c53a by Tatu Saloranta, dated Dec 26, 2020) adds these classes to the SubTypeValidator blocklist. This fix was already included in the upstream 2.13.3 release (May 14, 2022) when TuxCare onboarded it. The blocklist entries are present at lines 234-236 of SubTypeValidator.java, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.13.3. The vulnerability involves polymorphic deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource). The upstream fix (commit 567194c53a by Tatu Saloranta, dated Dec 26, 2020) adds these classes to the SubTypeValidator blocklist. This fix was already included in the upstream 2.13.3 release (May 14, 2022) when TuxCare onboarded it. The blocklist entries are present at lines 234-236 of SubTypeValidator.java, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:27:17.200297+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-36186. The vulnerability involves deserialization gadgets using org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) added these classes to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.3 release that TuxCare onboarded, so the vulnerable code pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-36186. The vulnerability involves deserialization gadgets using org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 by Tatu Saloranta) added these classes to the deserialization blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.3 release that TuxCare onboarded, so the vulnerable code pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:42:30.151541+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.13.3-tuxcare.2. The fix was already included in the upstream 2.13.3 release before TuxCare onboarding. The vulnerable gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) are present in the deserialization blacklist at SubTypeValidator.java lines 229-230, added by upstream commit 3e8fa3beea4 (author: Tatu Saloranta, Dec 26, 2020). This commit is an ancestor of the first TuxCare commit (322db7630dc, \"Onboard version 2.13.3\" by ssaprikin@cloudlinux.com), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.13.3-tuxcare.2. The fix was already included in the upstream 2.13.3 release before TuxCare onboarding. The vulnerable gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource) are present in the deserialization blacklist at SubTypeValidator.java lines 229-230, added by upstream commit 3e8fa3beea4 (author: Tatu Saloranta, Dec 26, 2020). This commit is an ancestor of the first TuxCare commit (322db7630dc, \"Onboard version 2.13.3\" by ssaprikin@cloudlinux.com), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8, related to deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target version 2.13.3 already contains the upstream fix (commit 33d96c13fe) that adds these two classes to the deserialization blocklist in SubTypeValidator.java. This fix was present in the upstream 2.13.3 release when TuxCare onboarded it, making the vulnerable code pattern never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8, related to deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource. The target version 2.13.3 already contains the upstream fix (commit 33d96c13fe) that adds these two classes to the deserialization blocklist in SubTypeValidator.java. This fix was present in the upstream 2.13.3 release when TuxCare onboarded it, making the vulnerable code pattern never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.13.3. The vulnerability involves polymorphic deserialization of dangerous gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource). The upstream fix (commit 33d96c13fe by Tatu Saloranta) adds these classes to the deserialization blocklist in SubTypeValidator.java, preventing their instantiation. This fix was already present in upstream release 2.13.3 before TuxCare onboarded it (first TuxCare commit 322db7630d by ssaprikin@cloudlinux.com). The vulnerable code pattern is not present because the upstream vendor already removed it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.13.3. The vulnerability involves polymorphic deserialization of dangerous gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource). The upstream fix (commit 33d96c13fe by Tatu Saloranta) adds these classes to the deserialization blocklist in SubTypeValidator.java, preventing their instantiation. This fix was already present in upstream release 2.13.3 before TuxCare onboarded it (first TuxCare commit 322db7630d by ssaprikin@cloudlinux.com). The vulnerable code pattern is not present because the upstream vendor already removed it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:15:05.878869+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 (stack overflow via deeply nested JSON) is NOT present in jackson-databind 2.13.3-tuxcare.2. The fix was already included in the upstream 2.13.3 release that TuxCare onboarded. The fix adds a MAX_DEPTH=1000 limit and depth tracking in UntypedObjectDeserializer.Vanilla, throwing JsonParseException when nesting exceeds the threshold. Fix commit fcfc4998ec by Taylor S. Marks was part of the upstream release (commit 322db7630d \"Onboard version 2.13.3\" by ssaprikin@cloudlinux.com brought it in). Code at lines 664-732 shows the complete defense: MAX_DEPTH constant, depth parameter threading through deserialize/mapArray/mapObject methods, and depth checks before processing nested structures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 (stack overflow via deeply nested JSON) is NOT present in jackson-databind 2.13.3-tuxcare.2. The fix was already included in the upstream 2.13.3 release that TuxCare onboarded. The fix adds a MAX_DEPTH=1000 limit and depth tracking in UntypedObjectDeserializer.Vanilla, throwing JsonParseException when nesting exceeds the threshold. Fix commit fcfc4998ec by Taylor S. Marks was part of the upstream release (commit 322db7630d \"Onboard version 2.13.3\" by ssaprikin@cloudlinux.com brought it in). Code at lines 664-732 shows the complete defense: MAX_DEPTH constant, depth parameter threading through deserialize/mapArray/mapObject methods, and depth checks before processing nested structures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:07:58.117916+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability required the ability to deserialize org.apache.xbean.propertyeditor.JndiConverter for JNDI injection attacks. This class is already blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java:138. The fix was shipped in the upstream jackson-databind 2.13.3 release (commit 914e7c9f2c, February 2020) before TuxCare onboarded this version (August 2026). The vulnerable pattern is absent due to the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability required the ability to deserialize org.apache.xbean.propertyeditor.JndiConverter for JNDI injection attacks. This class is already blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java:138. The fix was shipped in the upstream jackson-databind 2.13.3 release (commit 914e7c9f2c, February 2020) before TuxCare onboarded this version (August 2026). The vulnerable pattern is absent due to the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-9546. The vulnerability involves deserialization gadgets related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (FasterXML) fixed this by adding the gadget class to a blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.3 release, which TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target jackson-databind 2.13.3-tuxcare.2 is NOT affected by CVE-2020-9546. The vulnerability involves deserialization gadgets related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (FasterXML) fixed this by adding the gadget class to a blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.13.3 release, which TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:36:25.287060+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7, involving deserialization of the JtaTransactionConfig gadget class. The target version 2.13.3 is NOT vulnerable. The upstream fix (commit 1e64db6a2f, authored by Tatu Saloranta on 2020-02-29) added JtaTransactionConfig to the deserialization blocklist in SubTypeValidator.java. This fix shipped in the upstream release 2.13.3, which TuxCare onboarded in commit 322db7630dc. The blocklist entry is present at line 144 of SubTypeValidator.java and actively prevents deserialization of this gadget class via the validateSubType method called during bean deserialization. The vulnerable pattern (unblocked JtaTransactionConfig deserialization) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 affects jackson-databind versions before 2.9.10.4/2.8.11.6/2.7.9.7, involving deserialization of the JtaTransactionConfig gadget class. The target version 2.13.3 is NOT vulnerable. The upstream fix (commit 1e64db6a2f, authored by Tatu Saloranta on 2020-02-29) added JtaTransactionConfig to the deserialization blocklist in SubTypeValidator.java. This fix shipped in the upstream release 2.13.3, which TuxCare onboarded in commit 322db7630dc. The blocklist entry is present at line 144 of SubTypeValidator.java and actively prevents deserialization of this gadget class via the validateSubType method called during bean deserialization. The vulnerable pattern (unblocked JtaTransactionConfig deserialization) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:12:27.199890+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig via polymorphic type handling. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which actively prevents its deserialization. This fix was already present in upstream Jackson 2.13.3 before TuxCare onboarded the release (first TuxCare commit 322db7630d \"Onboard version 2.13.3\"). The target repository inherited this fix from the upstream release, making it not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.13.3-tuxcare.2. The vulnerability involves deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPConfig via polymorphic type handling. The upstream fix (commit 1e64db6a2f by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, which actively prevents its deserialization. This fix was already present in upstream Jackson 2.13.3 before TuxCare onboarded the release (first TuxCare commit 322db7630d \"Onboard version 2.13.3\"). The target repository inherited this fix from the upstream release, making it not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:44.196020+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 affects jackson-databind's polymorphic deserialization by allowing instantiation of dangerous gadget classes (specifically javax.swing.JTextPane among others). The target repository version 2.13.3-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in the upstream 2.13.3 release that TuxCare onboarded. The fix (commit 7dbf51bf78 by upstream maintainer Tatu Saloranta) added javax.swing.JTextPane and other classes to the SubTypeValidator blacklist, preventing their deserialization. This blacklist entry is present at line 151 of SubTypeValidator.java in the target. TuxCare did not need to backport this CVE to 2.13.3 since it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 affects jackson-databind's polymorphic deserialization by allowing instantiation of dangerous gadget classes (specifically javax.swing.JTextPane among others). The target repository version 2.13.3-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in the upstream 2.13.3 release that TuxCare onboarded. The fix (commit 7dbf51bf78 by upstream maintainer Tatu Saloranta) added javax.swing.JTextPane and other classes to the SubTypeValidator blacklist, preventing their deserialization. This blacklist entry is present at line 151 of SubTypeValidator.java in the target. TuxCare did not need to backport this CVE to 2.13.3 since it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED by CVE-2021-46877. The upstream fix for the JDK serialization DoS vulnerability was already present in the upstream 2.13.3 release (before TuxCare onboarding). The vulnerable code pattern (unbounded direct allocation based on attacker-controlled length field) does not exist in the target. The fix introduces LONGEST_EAGER_ALLOC=100KB limit and chunked reading via ByteArrayBuilder for larger sizes, preventing multi-GB heap allocation attacks. Fix commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by upstream author tatu.saloranta@iki.fi shipped in upstream 2.13.3, which is after the CVE's affected range (2.13.x before 2.13.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "Target jackson-databind 2.13.3-tuxcare.2 is NOT AFFECTED by CVE-2021-46877. The upstream fix for the JDK serialization DoS vulnerability was already present in the upstream 2.13.3 release (before TuxCare onboarding). The vulnerable code pattern (unbounded direct allocation based on attacker-controlled length field) does not exist in the target. The fix introduces LONGEST_EAGER_ALLOC=100KB limit and chunked reading via ByteArrayBuilder for larger sizes, preventing multi-GB heap allocation attacks. Fix commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by upstream author tatu.saloranta@iki.fi shipped in upstream 2.13.3, which is after the CVE's affected range (2.13.x before 2.13.1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:20:15.352131+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.13.3 is not affected by CVE-2026-50193. The vulnerable code pattern (WrapperForSerializer class with recursive _serializeNonRecursive method) does not exist in this version. The vulnerability was introduced during 2.14 development (commit d2ba1ada8, May 3, 2022) and fixed before 2.14.0 release (commit a1fa4ae4e, May 4, 2022). Version 2.13.3 uses simple delegation to ObjectWriter.write...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 Version 2.13.3 is not affected by CVE-2026-50193. The vulnerable code pattern (WrapperForSerializer class with recursive _serializeNonRecursive method) does not exist in this version. The vulnerability was introduced during 2.14 development (commit d2ba1ada8, May 3, 2022) and fixed before 2.14.0 release (commit a1fa4ae4e, May 4, 2022). Version 2.13.3 uses simple delegation to ObjectWriter.write..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T21:17:40.330962+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The advisory fix adds visibility checks specifically to buffered replay into unwrapped creator parameters. The checked handler has no creator replay method; its existing `processUnwrapped` checks visibility before setting properties (UnwrappedPropertyHandler.java:54). Explicit creator discovery rejects unnamed unwrapped parameters through `_reportUnwrappedCreatorProperty`, which calls a routine that throws `InvalidDefinitionException` (BasicDeserializerFactory.java:875, BasicDeserializerFactory.java:1152, DeserializationContext.java:1877). Named unwrapped creator properties are also rejected during deserializer resolution (BeanDeserializerBase.java:930).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The advisory fix adds visibility checks specifically to buffered replay into unwrapped creator parameters. The checked handler has no creator replay method; its existing `processUnwrapped` checks visibility before setting properties (UnwrappedPropertyHandler.java:54). Explicit creator discovery rejects unnamed unwrapped parameters through `_reportUnwrappedCreatorProperty`, which calls a routine that throws `InvalidDefinitionException` (BasicDeserializerFactory.java:875, BasicDeserializerFactory.java:1152, DeserializationContext.java:1877). Named unwrapped creator properties are also rejected during deserializer resolution (BeanDeserializerBase.java:930)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T11:12:54.249034+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:20:15.352131+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:54:00.084020+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:54:00.084020+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:54:00.084020+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:55:00.105841+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:55:00.105841+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.13.3-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:20:15.352131+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.13.3-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}