{
  "@id": "urn:uuid:098d3e42-8823-416b-831f-b85fc5a57aec",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 87,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:00:16.835233+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:05:07.573388+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.14.2. The vulnerability affects versions prior to 2.8.11 and 2.9.4, but the target version (2.14.2) already contains the upstream fix that adds blacklist entries for dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and others from issue #1737) to prevent polymorphic deserialization attacks. The fix was authored by upstream developer Tatu Saloranta and shipped in the upstream 2.14.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.14.2. The vulnerability affects versions prior to 2.8.11 and 2.9.4, but the target version (2.14.2) already contains the upstream fix that adds blacklist entries for dangerous classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and others from issue #1737) to prevent polymorphic deserialization attacks. The fix was authored by upstream developer Tatu Saloranta and shipped in the upstream 2.14.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:40:43.036497+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.14.2-tuxcare.5 is NOT affected by CVE-2017-17485. The vulnerability, which allowed unauthenticated remote code execution via blacklist bypass when Spring libraries are present, was fixed in upstream releases 2.7.9.2, 2.8.11, and 2.9.4 (December 2017). Version 2.14.2, released approximately 5 years later, contains the complete upstream fix including SubTypeValidator with comprehensive blacklist of dangerous deserialization gadget classes and sophisticated Spring framework class hierarchy checking. The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.14.2 release that TuxCare onboarded, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "The target jackson-databind version 2.14.2-tuxcare.5 is NOT affected by CVE-2017-17485. The vulnerability, which allowed unauthenticated remote code execution via blacklist bypass when Spring libraries are present, was fixed in upstream releases 2.7.9.2, 2.8.11, and 2.9.4 (December 2017). Version 2.14.2, released approximately 5 years later, contains the complete upstream fix including SubTypeValidator with comprehensive blacklist of dangerous deserialization gadget classes and sophisticated Spring framework class hierarchy checking. The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.14.2 release that TuxCare onboarded, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:25:18.997176+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.14.2-tuxcare.5 is NOT affected by CVE-2017-7525. The vulnerability (polymorphic deserialization allowing arbitrary code execution via gadget classes) has been fixed by the upstream vendor. The fix is implemented via the SubTypeValidator class which validates and blocks deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ObjectFactory, and others) before bean deserialization proceeds. This fix was already present in upstream version 2.14.2 when TuxCare onboarded it on commit 4f88cac9f4966d16670ab5173f01198b9aeb53aa.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target repository jackson-databind version 2.14.2-tuxcare.5 is NOT affected by CVE-2017-7525. The vulnerability (polymorphic deserialization allowing arbitrary code execution via gadget classes) has been fixed by the upstream vendor. The fix is implemented via the SubTypeValidator class which validates and blocks deserialization of dangerous classes (TemplatesImpl, InvokerTransformer, InstantiateTransformer, MethodClosure, ObjectFactory, and others) before bean deserialization proceeds. This fix was already present in upstream version 2.14.2 when TuxCare onboarded it on commit 4f88cac9f4966d16670ab5173f01198b9aeb53aa.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:59.149107+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 due to unsafe deserialization of org.apache.ibatis.parsing.XPathParser when default typing is enabled, allowing data exfiltration via XML external entity processing. The target version 2.14.2-tuxcare.4 is NOT AFFECTED because the upstream fix (blacklisting XPathParser in SubTypeValidator) was already present in the upstream release 2.14.2 that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta in May 2018 (commit 27b4defc270) and has been part of jackson-databind since version 2.7.9.4, long before version 2.14.2 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0 through 2.9.5 due to unsafe deserialization of org.apache.ibatis.parsing.XPathParser when default typing is enabled, allowing data exfiltration via XML external entity processing. The target version 2.14.2-tuxcare.4 is NOT AFFECTED because the upstream fix (blacklisting XPathParser in SubTypeValidator) was already present in the upstream release 2.14.2 that TuxCare onboarded. The fix was committed by upstream maintainer Tatu Saloranta in May 2018 (commit 27b4defc270) and has been part of jackson-databind since version 2.7.9.4, long before version 2.14.2 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:15:39.453186+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.14.2. The fix was included in the upstream release 2.14.2 that TuxCare onboarded. The vulnerable class jodd.db.connection.DataSourceConnectionProvider is blacklisted in SubTypeValidator.java (line 68), preventing polymorphic deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6, which predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.14.2. The fix was included in the upstream release 2.14.2 that TuxCare onboarded. The vulnerable class jodd.db.connection.DataSourceConnectionProvider is blacklisted in SubTypeValidator.java (line 68), preventing polymorphic deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 28badf7ef6, which predates the TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:47.656427+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.14.2-tuxcare.5 is NOT AFFECTED by CVE-2018-12023. The vulnerability involves polymorphic deserialization of Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP-based remote code execution when Default Typing is enabled. The fix\u2014adding these classes to SubTypeValidator's blacklist\u2014was implemented by upstream FasterXML maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release that TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "The target jackson-databind version 2.14.2-tuxcare.5 is NOT AFFECTED by CVE-2018-12023. The vulnerability involves polymorphic deserialization of Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP-based remote code execution when Default Typing is enabled. The fix\u2014adding these classes to SubTypeValidator's blacklist\u2014was implemented by upstream FasterXML maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release that TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:42:24.827100+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 affects jackson-databind versions before 2.9.7 by allowing arbitrary code execution via polymorphic deserialization of slf4j-ext classes (specifically org.slf4j.ext.EventData). The target repository (version 2.14.2-tuxcare.5) is NOT affected. The fix was already present in the upstream 2.14.2 release that TuxCare onboarded, added by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44. The blocklist in SubTypeValidator.java includes org.slf4j.ext.EventData and three other classes, preventing their deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 affects jackson-databind versions before 2.9.7 by allowing arbitrary code execution via polymorphic deserialization of slf4j-ext classes (specifically org.slf4j.ext.EventData). The target repository (version 2.14.2-tuxcare.5) is NOT affected. The fix was already present in the upstream 2.14.2 release that TuxCare onboarded, added by upstream commit 87d29af25e82a249ea15858e2d4ecbf64091db44. The blocklist in SubTypeValidator.java includes org.slf4j.ext.EventData and three other classes, preventing their deserialization. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:57:03.771822+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns polymorphic deserialization of dangerous BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) and related gadgets that could enable arbitrary code execution. The fix, which adds four dangerous class names to a deny-list in SubTypeValidator.java (lines 75-78), was authored by upstream maintainer Tatu Saloranta in commit 87d29af2 and shipped in upstream jackson-databind 2.14.2. TuxCare onboarded the already-patched upstream release. All four blocklist entries are present and actively enforced during bean deserialization via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns polymorphic deserialization of dangerous BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor) and related gadgets that could enable arbitrary code execution. The fix, which adds four dangerous class names to a deny-list in SubTypeValidator.java (lines 75-78), was authored by upstream maintainer Tatu Saloranta in commit 87d29af2 and shipped in upstream jackson-databind 2.14.2. TuxCare onboarded the already-patched upstream release. All four blocklist entries are present and actively enforced during bean deserialization via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:04:28.993792+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.2-tuxcare.5 is NOT affected by CVE-2018-14720. The four dangerous classes identified in the CVE (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 75-78, preventing their polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "The target jackson-databind 2.14.2-tuxcare.5 is NOT affected by CVE-2018-14720. The four dangerous classes identified in the CVE (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are blocked in SubTypeValidator.java lines 75-78, preventing their polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:33:03.457896+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.14.2-tuxcare.5 is not affected by CVE-2018-14721. The vulnerability, which allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class, was fixed in the upstream release. The fix (commit 87d29af25e) added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its polymorphic deserialization. This upstream fix was already present in version 2.14.2 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "The target repository jackson-databind version 2.14.2-tuxcare.5 is not affected by CVE-2018-14721. The vulnerability, which allowed SSRF attacks via polymorphic deserialization of the axis2-jaxws class, was fixed in the upstream release. The fix (commit 87d29af25e) added org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its polymorphic deserialization. This upstream fix was already present in version 2.14.2 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:39:18.885622+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is not present in jackson-databind 2.14.2-tuxcare.4. The target contains an upstream fix that blocks org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization via a blocklist in SubTypeValidator.java (line 85). This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 and was already present in upstream version 2.14.2 when TuxCare onboarded it (first TuxCare commit: 4f88cac9f4). The blocklist is actively enforced by BeanDeserializerFactory during bean deserialization, preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is not present in jackson-databind 2.14.2-tuxcare.4. The target contains an upstream fix that blocks org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization via a blocklist in SubTypeValidator.java (line 85). This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 and was already present in upstream version 2.14.2 when TuxCare onboarded it (first TuxCare commit: 4f88cac9f4). The blocklist is actively enforced by BeanDeserializerFactory during bean deserialization, preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:54:24.400671+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for OpenJPA classes in polymorphic deserialization. The target repository at version 2.14.2-tuxcare.5 already contains the upstream fix (commit 72cd4025a2 \"Fix #2186\") which adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 82-83). This fix was authored by the upstream maintainer Tatu Saloranta and shipped in upstream release 2.14.2, which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for OpenJPA classes in polymorphic deserialization. The target repository at version 2.14.2-tuxcare.5 already contains the upstream fix (commit 72cd4025a2 \"Fix #2186\") which adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 82-83). This fix was authored by the upstream maintainer Tatu Saloranta and shipped in upstream release 2.14.2, which TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:23:22.459243+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of dangerous jboss-common-core classes. The target version 2.14.2-tuxcare.5 already contains the upstream fix (commit 72cd4025) that blocks the four dangerous classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was included in the upstream 2.14.2 release that TuxCare onboarded, not added as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of dangerous jboss-common-core classes. The target version 2.14.2-tuxcare.5 already contains the upstream fix (commit 72cd4025) that blocks the four dangerous classes (org.jboss.util.propertyeditor.DocumentEditor, org.apache.openjpa.ee.RegistryManagedRuntime, org.apache.openjpa.ee.JNDIManagedRuntime, org.apache.axis2.transport.jms.JMSOutTransportInfo) in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was included in the upstream 2.14.2 release that TuxCare onboarded, not added as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability was fixed upstream by FasterXML in January 2018 (commit 038b471e2e) by adding two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.14.2 release that TuxCare onboarded on August 13, 2026. The blacklist prevents deserialization of these classes during polymorphic type handling, blocking the remote code execution attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability was fixed upstream by FasterXML in January 2018 (commit 038b471e2e) by adding two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream 2.14.2 release that TuxCare onboarded on August 13, 2026. The blacklist prevents deserialization of these classes during polymorphic type handling, blocking the remote code execution attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involved incomplete blacklisting of c3p0 DataSource classes that could be exploited for remote code execution via malicious JSON. The fix (commit 6799f8f10c by Tatu Saloranta) was already included in upstream release 2.14.2, which TuxCare onboarded. The target contains the complete defense in SubTypeValidator.java that blocks deserialization of any class matching 'com.mchange.v2.c3p0.*DataSource'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involved incomplete blacklisting of c3p0 DataSource classes that could be exploited for remote code execution via malicious JSON. The fix (commit 6799f8f10c by Tatu Saloranta) was already included in upstream release 2.14.2, which TuxCare onboarded. The target contains the complete defense in SubTypeValidator.java that blocks deserialization of any class matching 'com.mchange.v2.c3p0.*DataSource'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to missing validation of com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization. The target repository (version 2.14.2-tuxcare.5) is NOT AFFECTED because the upstream fix was already present in the 2.14.2 release that TuxCare onboarded. The fix adds \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist in SubTypeValidator.java (line 88), preventing instantiation of this gadget class. The fix commit (dda513bd7251b4f32b7b60b1c13740e3b5a43024) by upstream maintainer Tatu Saloranta was shipped in version 2.9.9 and is an ancestor of the TuxCare onboarding commit. The vulnerable code pattern (missing MiniAdmin validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9 due to missing validation of com.mysql.cj.jdbc.admin.MiniAdmin during polymorphic deserialization. The target repository (version 2.14.2-tuxcare.5) is NOT AFFECTED because the upstream fix was already present in the 2.14.2 release that TuxCare onboarded. The fix adds \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the deserialization blocklist in SubTypeValidator.java (line 88), preventing instantiation of this gadget class. The fix commit (dda513bd7251b4f32b7b60b1c13740e3b5a43024) by upstream maintainer Tatu Saloranta was shipped in version 2.9.9 and is an ancestor of the TuxCare onboarding commit. The vulnerable code pattern (missing MiniAdmin validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T18:25:03.088691+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization. Target version 2.14.2-tuxcare.5 is NOT AFFECTED because the fix was already present in upstream release 2.14.2 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:91 and prevents deser...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blocklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource in polymorphic deserialization. Target version 2.14.2-tuxcare.5 is NOT AFFECTED because the fix was already present in upstream release 2.14.2 before TuxCare onboarded it. The blocklist entry exists at SubTypeValidator.java:91 and prevents deser..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T07:06:53.319755+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.14.2 is NOT AFFECTED by CVE-2019-12814. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can read arbitrary local files. The vendor's fix (adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the blocklist) is already present in SubTypeValidator.java at lines 94-95. This fix was auth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.14.2 is NOT AFFECTED by CVE-2019-12814. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes that can read arbitrary local files. The vendor's fix (adding org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the blocklist) is already present in SubTypeValidator.java at lines 94-95. This fix was auth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:01.158878+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.14.2-tuxcare.4. The vulnerability involved missing blacklist entries in SubTypeValidator.java that allowed dangerous classes like net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to be deserialized, leading to remote code execution. The fix (adding these classes to DEFAULT_NO_DESER_CLASS_NAMES) is present in the target at SubTypeValidator.java lines 97-99. This fix was already included in the upstream jackson-databind 2.14.2 release that TuxCare onboarded on 2023-11-15 via commit 4f88cac9f4. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.14.2-tuxcare.4. The vulnerability involved missing blacklist entries in SubTypeValidator.java that allowed dangerous classes like net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to be deserialized, leading to remote code execution. The fix (adding these classes to DEFAULT_NO_DESER_CLASS_NAMES) is present in the target at SubTypeValidator.java lines 97-99. This fix was already included in the upstream jackson-databind 2.14.2 release that TuxCare onboarded on 2023-11-15 via commit 4f88cac9f4. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:28:43.500801+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.14.2 is not affected by CVE-2019-14439. The upstream fix (commit ad418eeb97 by Tatu Saloranta, July 2019) that adds ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the polymorphic deserialization deny-list was already present in upstream release 2.14.2 when TuxCare onboarded it. The vulnerable code pattern (missing deny-list entries for these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "Target jackson-databind 2.14.2 is not affected by CVE-2019-14439. The upstream fix (commit ad418eeb97 by Tatu Saloranta, July 2019) that adds ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the polymorphic deserialization deny-list was already present in upstream release 2.14.2 when TuxCare onboarded it. The vulnerable code pattern (missing deny-list entries for these gadget classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:06.899174+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT AFFECTED because the fix was already present in the upstream 2.14.2 release that TuxCare onboarded. The SubTypeValidator.java file contains blocklist entries for both HikariConfig (line 105) and HikariDataSource (line 107), preventing their deserialization. These entries were added by upstream commits d4983c740f and 73c1c2cc76, authored by Tatu Saloranta, which are ancestors of the TuxCare onboarding commit 4f88cac9. The vulnerable pattern (missing blocklist entries) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic typing vulnerability related to com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT AFFECTED because the fix was already present in the upstream 2.14.2 release that TuxCare onboarded. The SubTypeValidator.java file contains blocklist entries for both HikariConfig (line 105) and HikariDataSource (line 107), preventing their deserialization. These entries were added by upstream commits d4983c740f and 73c1c2cc76, authored by Tatu Saloranta, which are ancestors of the TuxCare onboarding commit 4f88cac9. The vulnerable pattern (missing blocklist entries) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:52:50.541440+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 does not affect jackson-databind 2.14.2-tuxcare.5. The vulnerability involved polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The fix, which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blacklist, was already present in the upstream version 2.14.2 before TuxCare onboarding. The blacklist entries are at lines 113-114 of SubTypeValidator.java, and the validator is actively invoked during polymorphic deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 does not affect jackson-databind 2.14.2-tuxcare.5. The vulnerability involved polymorphic deserialization of malicious commons-configuration JNDI classes leading to arbitrary code execution. The fix, which adds org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the SubTypeValidator blacklist, was already present in the upstream version 2.14.2 before TuxCare onboarding. The blacklist entries are at lines 113-114 of SubTypeValidator.java, and the validator is actively invoked during polymorphic deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, where polymorphic deserialization could instantiate the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) for arbitrary code execution. The target version 2.14.2 is not affected because the upstream fix was already present in the 2.14.2 release when TuxCare onboarded it. The fix adds the dangerous xalan class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its deserialization. Fix commit 998efd7082 was authored by upstream maintainer Tatu Saloranta on September 19, 2019, and is an ancestor of TuxCare's first commit (onboarding on August 13, 2026). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 affects jackson-databind versions before 2.9.10 and 2.10.0, where polymorphic deserialization could instantiate the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) for arbitrary code execution. The target version 2.14.2 is not affected because the upstream fix was already present in the 2.14.2 release when TuxCare onboarded it. The fix adds the dangerous xalan class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its deserialization. Fix commit 998efd7082 was authored by upstream maintainer Tatu Saloranta on September 19, 2019, and is an ancestor of TuxCare's first commit (onboarding on August 13, 2026). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:58.863426+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource as a gadget class for remote code execution. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in the upstream jackson-databind 2.14.2 release that TuxCare onboarded. The fix commit (73c1c2cc76) by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's first onboarding commit (4f88cac9f4 \"Onboard version 2.14.2\"). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource as a gadget class for remote code execution. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in the upstream jackson-databind 2.14.2 release that TuxCare onboarded. The fix commit (73c1c2cc76) by upstream maintainer Tatu Saloranta is an ancestor of TuxCare's first onboarding commit (4f88cac9f4 \"Onboard version 2.14.2\"). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:10.906994+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability affects versions 2.0.0 through 2.9.10 and involves unsafe deserialization of org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in September 2019 by adding these classes to SubTypeValidator's blocklist. The fix was already present in the upstream 2.14.2 release (November 2022) when TuxCare onboarded it, as confirmed by examining the onboarding commit 4f88cac9f4. The blocklist entries exist at SubTypeValidator.java lines 124-125 and are actively enforced by the validateSubType method, which throws JsonMappingException when these classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability affects versions 2.0.0 through 2.9.10 and involves unsafe deserialization of org.apache.commons.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource when Default Typing is enabled. The upstream vendor (FasterXML) fixed this in September 2019 by adding these classes to SubTypeValidator's blocklist. The fix was already present in the upstream 2.14.2 release (November 2022) when TuxCare onboarded it, as confirmed by examining the onboarding commit 4f88cac9f4. The blocklist entries exist at SubTypeValidator.java lines 124-125 and are actively enforced by the validateSubType method, which throws JsonMappingException when these classes are encountered during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:12:26.130269+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves polymorphic deserialization gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, and SharedPoolDataSource) that enable remote code execution when Default Typing is enabled. All three gadget classes are already blacklisted in SubTypeValidator.java (lines 124-127). The fix was introduced in upstream commit 9593e16cf5 by Tatu Saloranta and shipped in upstream release 2.14.2, which TuxCare then onboarded. The blacklist is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory during polymorphic type deserialization, blocking instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves polymorphic deserialization gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, and SharedPoolDataSource) that enable remote code execution when Default Typing is enabled. All three gadget classes are already blacklisted in SubTypeValidator.java (lines 124-127). The fix was introduced in upstream commit 9593e16cf5 by Tatu Saloranta and shipped in upstream release 2.14.2, which TuxCare then onboarded. The blacklist is actively enforced via SubTypeValidator.validateSubType() called from BeanDeserializerFactory during polymorphic type deserialization, blocking instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:39.614024+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic deserialization gadget in net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT AFFECTED because the upstream fix (commit 191a4cdf87 by tatu.saloranta@iki.fi) was already included in the upstream release 2.8.11.5/2.9.10 that TuxCare onboarded. The gadget class is blacklisted in SubTypeValidator.java:99, and the validation is enforced automatically during deserialization at BeanDeserializerFactory.java:141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 affects jackson-databind versions before 2.9.10 and 2.8.11.5 due to a polymorphic deserialization gadget in net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT AFFECTED because the upstream fix (commit 191a4cdf87 by tatu.saloranta@iki.fi) was already included in the upstream release 2.8.11.5/2.9.10 that TuxCare onboarded. The gadget class is blacklisted in SubTypeValidator.java:99, and the validation is enforced automatically during deserialization at BeanDeserializerFactory.java:141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:45:46.897208+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.14.2. The vulnerability involves polymorphic deserialization of log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) that can be exploited for JNDI injection when Default Typing is enabled. The upstream vendor fix (commit b5a304a985 by Tatu Saloranta) added these two classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.14.2 release that TuxCare onboarded, predating all TuxCare commits on this branch. The blocklist is enforced unconditionally during bean deserialization with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.14.2. The vulnerability involves polymorphic deserialization of log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) that can be exploited for JNDI injection when Default Typing is enabled. The upstream vendor fix (commit b5a304a985 by Tatu Saloranta) added these two classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already included in the upstream 2.14.2 release that TuxCare onboarded, predating all TuxCare commits on this branch. The blocklist is enforced unconditionally during bean deserialization with no bypass mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.2-tuxcare.5 is not affected by CVE-2019-20330. The vulnerability concerns missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI injection via polymorphic deserialization. These blocklist entries are already present in the target at SubTypeValidator.java lines 134-135. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release, before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target jackson-databind 2.14.2-tuxcare.5 is not affected by CVE-2019-20330. The vulnerability concerns missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable JNDI injection via polymorphic deserialization. These blocklist entries are already present in the target at SubTypeValidator.java lines 134-135. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release, before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:58:57.863833+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns unsafe deserialization of ignite-jta JNDI gadget classes that could lead to arbitrary code execution. The fix (adding org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider to the deserialization blocklist) is present in SubTypeValidator.java lines 157-160. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release before TuxCare onboarded it. The target version (2.14.2) is well beyond the CVE's affected version range (before 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns unsafe deserialization of ignite-jta JNDI gadget classes that could lead to arbitrary code execution. The fix (adding org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider to the deserialization blocklist) is present in SubTypeValidator.java lines 157-160. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind 2.14.2 release before TuxCare onboarded it. The target version (2.14.2) is well beyond the CVE's affected version range (before 2.9.10.4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target is version 2.14.2-tuxcare.5, which is significantly newer. The vulnerability involved deserialization gadgets related to org.apache.aries.transaction.jms classes. The upstream fix (commit 592872f423) added blocklist entries for XaPooledConnectionFactory and RecoverablePooledConnectionFactory to SubTypeValidator.java. This fix was already present in the upstream 2.14.2 release that TuxCare onboarded, as confirmed by git ancestry analysis. The blocklist entries are verified present at lines 163-164 of SubTypeValidator.java, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target is version 2.14.2-tuxcare.5, which is significantly newer. The vulnerability involved deserialization gadgets related to org.apache.aries.transaction.jms classes. The upstream fix (commit 592872f423) added blocklist entries for XaPooledConnectionFactory and RecoverablePooledConnectionFactory to SubTypeValidator.java. This fix was already present in the upstream 2.14.2 release that TuxCare onboarded, as confirmed by git ancestry analysis. The blocklist entries are verified present at lines 163-164 of SubTypeValidator.java, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:23:34.424796+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.14.2-tuxcare.5 is NOT affected by CVE-2020-10673. The vulnerability involves deserialization of the malicious gadget class com.caucho.config.types.ResourceRef. The fix (commit 1645efbd) that adds this class to the blacklist in SubTypeValidator.java was committed by upstream maintainer Tatu Saloranta on March 17, 2020, and was already included in the upstream jackson-databind 2.14.2 release that TuxCare onboarded on August 13, 2026. The vulnerable pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target jackson-databind version 2.14.2-tuxcare.5 is NOT affected by CVE-2020-10673. The vulnerability involves deserialization of the malicious gadget class com.caucho.config.types.ResourceRef. The fix (commit 1645efbd) that adds this class to the blacklist in SubTypeValidator.java was committed by upstream maintainer Tatu Saloranta on March 17, 2020, and was already included in the upstream jackson-databind 2.14.2 release that TuxCare onboarded on August 13, 2026. The vulnerable pattern (missing blacklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.2-tuxcare.5) is not affected by CVE-2020-10968. The vulnerability concerns deserialization of the malicious gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix, which adds this class and related bus-proxy classes to the deserialization blocklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f and was already present in the upstream 2.14.2 release when TuxCare onboarded it. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.2-tuxcare.5) is not affected by CVE-2020-10968. The vulnerability concerns deserialization of the malicious gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix, which adds this class and related bus-proxy classes to the deserialization blocklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta in commit 05d7e0e13f and was already present in the upstream 2.14.2 release when TuxCare onboarded it. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving javax.swing.JEditorPane. The target version 2.14.2-tuxcare.5 is NOT affected because the upstream fix (adding JEditorPane to the deserialization blocklist) was already present in the upstream 2.14.2 release when TuxCare onboarded it. The fix was originally committed by upstream maintainer Tatu Saloranta in March 2020 (commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60), and version 2.14.2 (released much later) inherited this protection. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget involving javax.swing.JEditorPane. The target version 2.14.2-tuxcare.5 is NOT affected because the upstream fix (adding JEditorPane to the deserialization blocklist) was already present in the upstream 2.14.2 release when TuxCare onboarded it. The fix was originally committed by upstream maintainer Tatu Saloranta in March 2020 (commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60), and version 2.14.2 (released much later) inherited this protection. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT affected by CVE-2020-11111. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes. The fix - adding these classes to the SubTypeValidator blocklist - was already present in the upstream release 2.14.2 that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit c14c9f99ed (March 26, 2020), which predates TuxCare's onboarding of this version. While TuxCare did separately backport this CVE fix to older versions (2.9.10.3), the 2.14.2 line already contained the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT affected by CVE-2020-11111. The vulnerability concerns deserialization gadgets in org.apache.activemq.* classes. The fix - adding these classes to the SubTypeValidator blocklist - was already present in the upstream release 2.14.2 that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta in commit c14c9f99ed (March 26, 2020), which predates TuxCare's onboarding of this version. While TuxCare did separately backport this CVE fix to older versions (2.9.10.3), the 2.14.2 line already contained the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (version 2.14.2-tuxcare.5) is NOT AFFECTED because the upstream vendor fix (commit 05d7e0e13f from March 2020) was already included in the upstream release 2.14.2 that TuxCare onboarded. The fix adds the dangerous RmiProvider class to SubTypeValidator's deserialization blocklist, preventing instantiation of this gadget type during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (version 2.14.2-tuxcare.5) is NOT AFFECTED because the upstream vendor fix (commit 05d7e0e13f from March 2020) was already included in the upstream release 2.14.2 that TuxCare onboarded. The fix adds the dangerous RmiProvider class to SubTypeValidator's deserialization blocklist, preventing instantiation of this gadget type during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.2) is not affected by CVE-2020-11113. The fix that adds org.apache.openjpa.ee.WASRegistryManagedRuntime to the deserialization blocklist was already present in the upstream release 2.14.2 before TuxCare onboarded it. The upstream fix commit e2ba12d5d60715d95105e3e790fc234cfb59893d by Tatu Saloranta (March 28, 2020) is an ancestor of both HEAD and the first TuxCare onboarding commit, confirming the vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.2) is not affected by CVE-2020-11113. The fix that adds org.apache.openjpa.ee.WASRegistryManagedRuntime to the deserialization blocklist was already present in the upstream release 2.14.2 before TuxCare onboarded it. The upstream fix commit e2ba12d5d60715d95105e3e790fc234cfb59893d by Tatu Saloranta (March 28, 2020) is an ancestor of both HEAD and the first TuxCare onboarding commit, confirming the vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 and relates to deserialization gadgets in Spring AOP classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The target version 2.14.2-tuxcare.5 already contains the upstream fix that blocks these classes in SubTypeValidator. The fix was applied by upstream maintainer Tatu Saloranta in commit 113e89fb08 (April 2020) and shipped with upstream release 2.14.2, which TuxCare later onboarded. The vulnerable code pattern has been removed before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 and relates to deserialization gadgets in Spring AOP classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean). The target version 2.14.2-tuxcare.5 already contains the upstream fix that blocks these classes in SubTypeValidator. The fix was applied by upstream maintainer Tatu Saloranta in commit 113e89fb08 (April 2020) and shipped with upstream release 2.14.2, which TuxCare later onboarded. The vulnerable code pattern has been removed before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.jelly.impl.Embedded through Jackson's polymorphic type handling. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already included in the upstream jackson-databind 2.10.4 release (April 2020) and is present in version 2.14.2. The blocklist entry exists at SubTypeValidator.java:189, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves deserialization of the malicious gadget class org.apache.commons.jelly.impl.Embedded through Jackson's polymorphic type handling. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, was already included in the upstream jackson-databind 2.10.4 release (April 2020) and is present in version 2.14.2. The blocklist entry exists at SubTypeValidator.java:189, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is NOT present in jackson-databind 2.14.2. The vulnerability affects versions before 2.9.10.5, and the fix (blacklisting oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) was already included in the upstream 2.14.2 release by FasterXML. The target version is based on this upstream release and contains the complete fix in SubTypeValidator.java at line 192.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is NOT present in jackson-databind 2.14.2. The vulnerability affects versions before 2.9.10.5, and the fix (blacklisting oadd.org.apache.xalan.lib.sql.JNDIConnectionPool) was already included in the upstream 2.14.2 release by FasterXML. The target version is based on this upstream release and contains the complete fix in SubTypeValidator.java at line 192.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind versions before 2.9.10.5, involving deserialization gadgets with Oracle JMS AQjms classes. The target version 2.14.2 contains the upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e) which added these five Oracle JMS classes to the deserialization blacklist in SubTypeValidator.java. The fix was already present in the upstream 2.14.2 release that TuxCare onboarded, making this an upstream-authored fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 affects jackson-databind versions before 2.9.10.5, involving deserialization gadgets with Oracle JMS AQjms classes. The target version 2.14.2 contains the upstream fix (commit 5c8642aeae9c756b438ab7637c90ef3c77966e6e) which added these five Oracle JMS classes to the deserialization blacklist in SubTypeValidator.java. The fix was already present in the upstream 2.14.2 release that TuxCare onboarded, making this an upstream-authored fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability allowed remote code execution via polymorphic deserialization of the dangerous class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The fix that blocks this class in SubTypeValidator was authored by upstream vendor Tatu Saloranta (commit 840eae2ca8, May 1, 2020) and was already included in the upstream 2.14.2 release that TuxCare onboarded. The blocklist entry exists at line 119 of SubTypeValidator.java and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability allowed remote code execution via polymorphic deserialization of the dangerous class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The fix that blocks this class in SubTypeValidator was authored by upstream vendor Tatu Saloranta (commit 840eae2ca8, May 1, 2020) and was already included in the upstream 2.14.2 release that TuxCare onboarded. The blocklist entry exists at line 119 of SubTypeValidator.java and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind versions before 2.9.10.5, enabling JNDI injection attacks via the org.jsecurity.realm.jndi.JndiRealmFactory gadget class. The target repository (version 2.14.2) already contains the upstream fix that blacklists this class in SubTypeValidator.java at line 207. This fix was authored by upstream maintainer Tatu Saloranta in commit f6d9c664 and was already present in upstream version 2.14.2 when TuxCare onboarded it (commit 4f88cac9f4). The blacklist is enforced through BeanDeserializerFactory._validateSubType() during deserialization, preventing instantiation of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind versions before 2.9.10.5, enabling JNDI injection attacks via the org.jsecurity.realm.jndi.JndiRealmFactory gadget class. The target repository (version 2.14.2) already contains the upstream fix that blacklists this class in SubTypeValidator.java at line 207. This fix was authored by upstream maintainer Tatu Saloranta in commit f6d9c664 and was already present in upstream version 2.14.2 when TuxCare onboarded it (commit 4f88cac9f4). The blacklist is enforced through BeanDeserializerFactory._validateSubType() during deserialization, preventing instantiation of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:17:28.173576+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.14.2. The vulnerability involves a deserialization gadget class (br.com.anteros.dbcp.AnterosDBCPDataSource) that could enable arbitrary code execution via polymorphic type handling. The upstream fix (commit 3d97153944f by Tatu Saloranta, 2020-08-10) added this class to the SubTypeValidator blocklist, preventing its instantiation during deserialization. This fix was already included in the jackson-databind 2.14.2 upstream release that TuxCare onboarded, predating any TuxCare modifications. The defense is active and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.14.2. The vulnerability involves a deserialization gadget class (br.com.anteros.dbcp.AnterosDBCPDataSource) that could enable arbitrary code execution via polymorphic type handling. The upstream fix (commit 3d97153944f by Tatu Saloranta, 2020-08-10) added this class to the SubTypeValidator blocklist, preventing its instantiation during deserialization. This fix was already included in the jackson-databind 2.14.2 upstream release that TuxCare onboarded, predating any TuxCare modifications. The defense is active and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:01.936733+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration which can lead to JNDI injection and remote code execution. The fix (adding this class to the denylist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.14.2 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6cc9f1a1, which predates TuxCare's onboarding commit 4f88cac9f4. The target version shipped with the fix from day one.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves deserialization of the gadget class com.pastdev.httpcomponents.configuration.JndiConfiguration which can lead to JNDI injection and remote code execution. The fix (adding this class to the denylist in SubTypeValidator.java) was already present in the upstream jackson-databind 2.14.2 release that TuxCare onboarded. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 6cc9f1a1, which predates TuxCare's onboarding commit 4f88cac9f4. The target version shipped with the fix from day one.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.14.2-tuxcare.5. The upstream vendor (FasterXML) fixed this vulnerability in commit 612f971b78 by adding two XML parser security features to DOMDeserializer.java: (1) disallow-doctype-decl=true, and (2) load-external-dtd=false. These protections prevent XML external entity (XXE) attacks by blocking DOCTYPE declarations and external DTD loading. The fix was already present in the upstream release 2.14.2 that TuxCare onboarded, making this version not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.14.2-tuxcare.5. The upstream vendor (FasterXML) fixed this vulnerability in commit 612f971b78 by adding two XML parser security features to DOMDeserializer.java: (1) disallow-doctype-decl=true, and (2) load-external-dtd=false. These protections prevent XML external entity (XXE) attacks by blocking DOCTYPE declarations and external DTD loading. The fix was already present in the upstream release 2.14.2 that TuxCare onboarded, making this version not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:19:24.952513+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.14.2-tuxcare.5 is not affected by CVE-2020-35490. The vulnerability, which allowed unsafe deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes, was fixed by upstream commit 41b8bdb5ccc in December 2020. This fix was already present in the upstream 2.14.2 release that TuxCare onboarded, as confirmed by the blocklist entries in SubTypeValidator.java lines 217-218.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "The target repository jackson-databind 2.14.2-tuxcare.5 is not affected by CVE-2020-35490. The vulnerability, which allowed unsafe deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource classes, was fixed by upstream commit 41b8bdb5ccc in December 2020. This fix was already present in the upstream 2.14.2 release that TuxCare onboarded, as confirmed by the blocklist entries in SubTypeValidator.java lines 217-218.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.14.2-tuxcare.4 is NOT affected by CVE-2020-35491. The fix (blacklisting org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) is present in SubTypeValidator.java lines 217-218. This fix was introduced by upstream author Tatu Saloranta in commit 41b8bdb5cc and was already included in the upstream 2.14.2 release that TuxCare onboarded. The vulnerable code pattern (unblocked deserialization of these gadget classes) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "Target jackson-databind 2.14.2-tuxcare.4 is NOT affected by CVE-2020-35491. The fix (blacklisting org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) is present in SubTypeValidator.java lines 217-218. This fix was introduced by upstream author Tatu Saloranta in commit 41b8bdb5cc and was already included in the upstream 2.14.2 release that TuxCare onboarded. The vulnerable code pattern (unblocked deserialization of these gadget classes) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:53:26.160394+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerable gadget class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is already blacklisted in SubTypeValidator.java at line 240. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-12-26 and shipped in the upstream 2.14.2 release (2023-01-28) that TuxCare onboarded via commit 4f88cac9f4. The blacklist is actively enforced during bean deserialization through BeanDeserializerFactory._validateSubType(), preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerable gadget class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is already blacklisted in SubTypeValidator.java at line 240. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-12-26 and shipped in the upstream 2.14.2 release (2023-01-28) that TuxCare onboarded via commit 4f88cac9f4. The blacklist is actively enforced during bean deserialization through BeanDeserializerFactory._validateSubType(), preventing instantiation of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:21:23.269302+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.2-tuxcare.5 is NOT AFFECTED by CVE-2020-36179. The vulnerability pattern has been removed by an upstream fix that was already present in jackson-databind 2.14.2 before TuxCare onboarded this version. The fix (commit 3ded28aece) added all DriverAdapterCPDS class variants to the deserialization blocklist, preventing JNDI injection attacks via this gadget class. The fix was authored by Tatu Saloranta (upstream maintainer) on 2020-12-31, well before TuxCare's onboarding on 2026-08-13.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "The target jackson-databind 2.14.2-tuxcare.5 is NOT AFFECTED by CVE-2020-36179. The vulnerability pattern has been removed by an upstream fix that was already present in jackson-databind 2.14.2 before TuxCare onboarded this version. The fix (commit 3ded28aece) added all DriverAdapterCPDS class variants to the deserialization blocklist, preventing JNDI injection attacks via this gadget class. The fix was authored by Tatu Saloranta (upstream maintainer) on 2020-12-31, well before TuxCare's onboarding on 2026-08-13.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:33:21.899203+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability relates to deserialization gadgets (DriverAdapterCPDS variants) that could enable malicious operations through polymorphic type handling. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream jackson-databind 2.14.2 release that TuxCare onboarded, blocking all five DriverAdapterCPDS variants in SubTypeValidator.java. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability relates to deserialization gadgets (DriverAdapterCPDS variants) that could enable malicious operations through polymorphic type handling. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream jackson-databind 2.14.2 release that TuxCare onboarded, blocking all five DriverAdapterCPDS variants in SubTypeValidator.java. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:40:07.551074+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns Jackson's polymorphic deserialization allowing instantiation of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`. The fix was already present in upstream version 2.14.2, which TuxCare onboarded. The SubTypeValidator denylist at line 228 blocks deserialization of this class, throwing \"Illegal type to deserialize: prevented for security reasons\" when encountered. Fix commit 3ded28aece (authored by upstream maintainer Tatu Saloranta on 2020-12-31) was shipped in upstream 2.14.2 release (2023-01-28), before TuxCare's first onboarding commit 4f88cac9f4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns Jackson's polymorphic deserialization allowing instantiation of the gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`. The fix was already present in upstream version 2.14.2, which TuxCare onboarded. The SubTypeValidator denylist at line 228 blocks deserialization of this class, throwing \"Illegal type to deserialize: prevented for security reasons\" when encountered. Fix commit 3ded28aece (authored by upstream maintainer Tatu Saloranta on 2020-12-31) was shipped in upstream 2.14.2 release (2023-01-28), before TuxCare's first onboarding commit 4f88cac9f4.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:11:01.674474+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 addresses deserialization gadget exploitation via org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related variants. The vulnerability is NOT present in jackson-databind 2.14.2-tuxcare.5 because the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.14.2 release when TuxCare onboarded it. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java (lines 123, 193, 219, 228, 234), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 addresses deserialization gadget exploitation via org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related variants. The vulnerability is NOT present in jackson-databind 2.14.2-tuxcare.5 because the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) was already included in the upstream 2.14.2 release when TuxCare onboarded it. All five DriverAdapterCPDS class variants are blocked in SubTypeValidator.java (lines 123, 193, 219, 228, 234), preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:07.841451+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.2-tuxcare.5 is not affected by CVE-2020-36183. The fix that blocks deserialization of org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool was already present in the upstream jackson-databind 2.14.2 release (commit 12e23c962ffb by Tatu Saloranta on 2020-12-31) before TuxCare onboarded this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "The target jackson-databind 2.14.2-tuxcare.5 is not affected by CVE-2020-36183. The fix that blocks deserialization of org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool was already present in the upstream jackson-databind 2.14.2 release (commit 12e23c962ffb by Tatu Saloranta on 2020-12-31) before TuxCare onboarded this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind 2.x before 2.9.10.8. The target version 2.14.2 already contains the upstream fix (commit 567194c5 by Tatu Saloranta, 2020-12-26) that adds org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream 2.14.2 release before TuxCare onboarded it, so the vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind 2.x before 2.9.10.8. The target version 2.14.2 already contains the upstream fix (commit 567194c5 by Tatu Saloranta, 2020-12-26) that adds org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blacklist in SubTypeValidator.java. This fix shipped in the upstream 2.14.2 release before TuxCare onboarded it, so the vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:03:43.787457+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target version 2.14.2 already contains the upstream fix (commit 567194c5) that adds these classes to the SubTypeValidator denylist, preventing their deserialization. This fix was shipped in the upstream release 2.14.2 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The target version 2.14.2 already contains the upstream fix (commit 567194c5) that adds these classes to the SubTypeValidator denylist, preventing their deserialization. This fix was shipped in the upstream release 2.14.2 that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:28:16.587354+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT affected by CVE-2020-36186. The vulnerability relates to missing blocklist entries for `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource` and `SharedPoolDataSource` gadget classes that could enable deserialization-based RCE/JNDI injection. These blocklist entries are present in the target at SubTypeValidator.java lines 229-230, added by upstream commit 3e8fa3beea4 (authored by Tatu Saloranta on 2020-12-26). This fix was already included in upstream Jackson 2.14.2 before TuxCare onboarded it. The CVE affects versions before 2.9.10.8, and the target version 2.14.2 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT affected by CVE-2020-36186. The vulnerability relates to missing blocklist entries for `org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource` and `SharedPoolDataSource` gadget classes that could enable deserialization-based RCE/JNDI injection. These blocklist entries are present in the target at SubTypeValidator.java lines 229-230, added by upstream commit 3e8fa3beea4 (authored by Tatu Saloranta on 2020-12-26). This fix was already included in upstream Jackson 2.14.2 before TuxCare onboarded it. The CVE affects versions before 2.9.10.8, and the target version 2.14.2 is well beyond that threshold.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:42:56.737779+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is NOT present in jackson-databind 2.14.2. The upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was already included in the upstream jackson-databind 2.14.0 release (December 2020), which predates the 2.14.2 release that TuxCare onboarded. The fix commit (3e8fa3beea) was authored by Tatu Saloranta, the upstream maintainer, and is present in the target at SubTypeValidator.java lines 226-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is NOT present in jackson-databind 2.14.2. The upstream fix that blocks deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was already included in the upstream jackson-databind 2.14.0 release (December 2020), which predates the 2.14.2 release that TuxCare onboarded. The fix commit (3e8fa3beea) was authored by Tatu Saloranta, the upstream maintainer, and is present in the target at SubTypeValidator.java lines 226-230.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:48:33.739879+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.14.2 is not affected by CVE-2020-36188. The upstream fix that blocks deserialization of `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource` and `DriverManagerConnectionSource` was committed by upstream maintainer Tatu Saloranta (commit 33d96c13fe) and shipped in upstream release 2.12.1 and all subsequent versions including 2.14.2. TuxCare onboarded version 2.14.2 which already contained this fix. The blocklist is enforced by SubTypeValidator.validateSubType() which throws an exception when these classes are encountered during polymorphic deserialization, preventing the JNDI injection attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "The target jackson-databind 2.14.2 is not affected by CVE-2020-36188. The upstream fix that blocks deserialization of `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource` and `DriverManagerConnectionSource` was committed by upstream maintainer Tatu Saloranta (commit 33d96c13fe) and shipped in upstream release 2.12.1 and all subsequent versions including 2.14.2. TuxCare onboarded version 2.14.2 which already contained this fix. The blocklist is enforced by SubTypeValidator.validateSubType() which throws an exception when these classes are encountered during polymorphic deserialization, preventing the JNDI injection attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is not present in jackson-databind 2.14.2. The vulnerable class com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource is already blacklisted in SubTypeValidator.java at line 224, preventing deserialization. This fix was introduced by upstream maintainer Tatu Saloranta in commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 and was already present in the upstream 2.14.2 release before TuxCare onboarded it (2056 commits before the onboarding commit 4f88cac9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is not present in jackson-databind 2.14.2. The vulnerable class com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource is already blacklisted in SubTypeValidator.java at line 224, preventing deserialization. This fix was introduced by upstream maintainer Tatu Saloranta in commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 and was already present in the upstream 2.14.2 release before TuxCare onboarded it (2056 commits before the onboarding commit 4f88cac9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:15:05.878869+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability (stack overflow via deeply nested JSON) was fixed by upstream in commit 8238ab41d0 by replacing the recursive deserialization algorithm with a non-recursive iterative implementation (UntypedObjectDeserializerNR). This fix was already present in the upstream 2.14.2 release that TuxCare onboarded (commit 4f88cac9). The vulnerable recursive code path in the standard configuration is no longer reachable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.14.2-tuxcare.5. The vulnerability (stack overflow via deeply nested JSON) was fixed by upstream in commit 8238ab41d0 by replacing the recursive deserialization algorithm with a non-recursive iterative implementation (UntypedObjectDeserializerNR). This fix was already present in the upstream 2.14.2 release that TuxCare onboarded (commit 4f88cac9). The vulnerable recursive code path in the standard configuration is no longer reachable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.14.2. The vulnerability involves unsafe deserialization of org.apache.xbean.propertyeditor.JndiConverter enabling JNDI injection attacks. The fix (adding JndiConverter to the blocklist) was already present in the upstream 2.14.2 release. The blocklist at SubTypeValidator.java:138 blocks this class, and the validation is enforced during deserialization via BeanDeserializerFactory._validateSubType(). The fix was authored by upstream maintainer Tatu Saloranta in commit 914e7c9f (Feb 2020) and shipped with the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.14.2. The vulnerability involves unsafe deserialization of org.apache.xbean.propertyeditor.JndiConverter enabling JNDI injection attacks. The fix (adding JndiConverter to the blocklist) was already present in the upstream 2.14.2 release. The blocklist at SubTypeValidator.java:138 blocks this class, and the validation is enforced during deserialization via BeanDeserializerFactory._validateSubType(). The fix was authored by upstream maintainer Tatu Saloranta in commit 914e7c9f (Feb 2020) and shipped with the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.14.2 is not affected because it already contains the upstream fix (commit 1e64db6a2f) that adds HikariConfig to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was included in jackson-databind 2.9.10.4 (released March 2020), well before the 2.14.2 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The target version 2.14.2 is not affected because it already contains the upstream fix (commit 1e64db6a2f) that adds HikariConfig to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and was included in jackson-databind 2.9.10.4 (released March 2020), well before the 2.14.2 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:36:59.729049+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves unsafe deserialization of the ibatis-sqlmap gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The upstream fix (commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by Tatu Saloranta) added this class to SubTypeValidator's blocklist, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.14.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (4f88cac9f4966d16670ab5173f01198b9aeb53aa). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability involves unsafe deserialization of the ibatis-sqlmap gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig`. The upstream fix (commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb by Tatu Saloranta) added this class to SubTypeValidator's blocklist, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.14.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare onboarding commit (4f88cac9f4966d16670ab5173f01198b9aeb53aa). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:14.329691+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT vulnerable because the fix was already present in the upstream release 2.14.2. The blocklist entry for AnterosDBCPConfig was added by upstream commit 9f4e97019f (authored by Tatu Saloranta) which shipped in jackson-databind 2.14.2 before TuxCare onboarded it. The SubTypeValidator enforces this blocklist at SubTypeValidator.java:145, preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 affects jackson-databind versions before 2.9.10.4, 2.8.11.6, and 2.7.9.7 due to unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPConfig. The target repository (jackson-databind 2.14.2-tuxcare.5) is NOT vulnerable because the fix was already present in the upstream release 2.14.2. The blocklist entry for AnterosDBCPConfig was added by upstream commit 9f4e97019f (authored by Tatu Saloranta) which shipped in jackson-databind 2.14.2 before TuxCare onboarded it. The SubTypeValidator enforces this blocklist at SubTypeValidator.java:145, preventing deserialization of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:09:27.722120+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns missing blocklist entries for deserialization gadget classes (notably javax.swing.JTextPane and others). The upstream fix (commit 7dbf51bf by Tatu Saloranta) was already included in the upstream 2.14.2 release that TuxCare onboarded. All required blocklist entries are present in SubTypeValidator.java lines 149-214, including javax.swing.JTextPane (line 151), javax.swing.JEditorPane (line 150), and dozens of other gadget classes from the patch. The defense mechanism actively blocks deserialization of these dangerous classes via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability concerns missing blocklist entries for deserialization gadget classes (notably javax.swing.JTextPane and others). The upstream fix (commit 7dbf51bf by Tatu Saloranta) was already included in the upstream 2.14.2 release that TuxCare onboarded. All required blocklist entries are present in SubTypeValidator.java lines 149-214, including javax.swing.JTextPane (line 151), javax.swing.JEditorPane (line 150), and dozens of other gadget classes from the patch. The defense mechanism actively blocks deserialization of these dangerous classes via the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind's JDK serialization of JsonNode, allowing DoS via unbounded memory allocation from malicious length values. The target (2.14.2-tuxcare.5) contains the complete upstream fix from commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta. This fix adds a 100KB eager allocation limit (LONGEST_EAGER_ALLOC) and chunked reading for larger data in NodeSerialization.java. The fix was already present in upstream 2.14.2 when TuxCare onboarded it (verified via ancestry check with first TuxCare commit 4f88cac9f4966d16670ab5173f01198b9aeb53aa). Verdict: not_affected because the vulnerable pattern is absent; the fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 affects jackson-databind's JDK serialization of JsonNode, allowing DoS via unbounded memory allocation from malicious length values. The target (2.14.2-tuxcare.5) contains the complete upstream fix from commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta. This fix adds a 100KB eager allocation limit (LONGEST_EAGER_ALLOC) and chunked reading for larger data in NodeSerialization.java. The fix was already present in upstream 2.14.2 when TuxCare onboarded it (verified via ancestry check with first TuxCare commit 4f88cac9f4966d16670ab5173f01198b9aeb53aa). Verdict: not_affected because the vulnerable pattern is absent; the fix shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:20.075693+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability (resource exhaustion via deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0. The target version 2.14.2 already contains the upstream fix (commit d78d00ee7b by Tatu Saloranta) which adds depth checks in primitive deserializers to reject nested arrays. The fix was present in the upstream release that TuxCare onboarded, not added as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 is NOT present in jackson-databind 2.14.2-tuxcare.5. The vulnerability (resource exhaustion via deeply nested wrapper arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0. The target version 2.14.2 already contains the upstream fix (commit d78d00ee7b by Tatu Saloranta) which adds depth checks in primitive deserializers to reject nested arrays. The fix was present in the upstream release that TuxCare onboarded, not added as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:57:07.115751+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 is NOT present in jackson-databind 2.14.2. The vulnerability allows resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The upstream fix (commit 063183589 by Tatu Saloranta) was already included in jackson-databind 2.14.2 before TuxCare onboarded it. The fix adds checks in BeanDeserializer._deserializeFromArray() and StdDeserializer.handleNestedArrayForSingle() to reject nested arrays, preventing the attack. The defense code is present at multiple defensive layers in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 is NOT present in jackson-databind 2.14.2. The vulnerability allows resource exhaustion via deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The upstream fix (commit 063183589 by Tatu Saloranta) was already included in jackson-databind 2.14.2 before TuxCare onboarded it. The fix adds checks in BeanDeserializer._deserializeFromArray() and StdDeserializer.handleNestedArrayForSingle() to reject nested arrays, preventing the attack. The defense code is present at multiple defensive layers in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T01:07:55.976356+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T20:16:50.097562+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 affects jackson-databind versions before 2.14.0, causing StackOverflowError when serializing deeply nested JsonNode structures via toString(). The target version 2.14.2-tuxcare.5 contains the complete fix from upstream commit a1fa4ae4ec, which replaced recursive serialization with an iterative implementation using IteratorStack. This fix was already present in the upstream 2.14.0...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 affects jackson-databind versions before 2.14.0, causing StackOverflowError when serializing deeply nested JsonNode structures via toString(). The target version 2.14.2-tuxcare.5 contains the complete fix from upstream commit a1fa4ae4ec, which replaced recursive serialization with an iterative implementation using IteratorStack. This fix was already present in the upstream 2.14.0..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T01:55:00.120954+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.14.2 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped on creator parameters, a feature that was not implemented until version 2.19.0 (commit 502fe888da, November 2024). Version 2.14.2 explicitly rejects classes with unwrapped creator parameters at deserialization time with InvalidDefinitionException. The vulnerable method processUnwrapped...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Target version 2.14.2 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped on creator parameters, a feature that was not implemented until version 2.19.0 (commit 502fe888da, November 2024). Version 2.14.2 explicitly rejects classes with unwrapped creator parameters at deserialization time with InvalidDefinitionException. The vulnerable method processUnwrapped..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T11:00:16.835233+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.2-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "action_statement": "Vulnerability CVE-2026-59888 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.2-tuxcare.6."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T13:55:00.107182+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.2-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.14.2-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T09:34:33.918851+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.14.2-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.14.2-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}