{
  "@id": "urn:uuid:54925444-5e02-4864-a376-62e50dca119e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T11:25:16.933084+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 fix is present in target jackson-databind 2.15.2. The vulnerability allowed arbitrary code execution via polymorphic deserialization of dangerous classes. The upstream fix (commit ddfddfba64 by tatu.saloranta@iki.fi) added blacklist entries for java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes. These protections are present in SubTypeValidator.java at lines 47-51, with enhanced pattern-based checking for C3P0 classes (lines 288-297). The fix was shipped in upstream release 2.15.2 before TuxCare onboarded it (first TuxCare commit 4da4dfb3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 fix is present in target jackson-databind 2.15.2. The vulnerability allowed arbitrary code execution via polymorphic deserialization of dangerous classes. The upstream fix (commit ddfddfba64 by tatu.saloranta@iki.fi) added blacklist entries for java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and Spring/C3P0 classes. These protections are present in SubTypeValidator.java at lines 47-51, with enhanced pattern-based checking for C3P0 classes (lines 288-297). The fix was shipped in upstream release 2.15.2 before TuxCare onboarded it (first TuxCare commit 4da4dfb3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability allowed remote code execution via polymorphic deserialization of malicious JSON containing Spring/C3P0/Tomcat gadget classes when bypassing an incomplete blacklist. The target contains the complete fix: SubTypeValidator with comprehensive blacklist (including all CVE-2017-17485 gadgets) and Spring class hierarchy checks, introduced by upstream commit 2235894210 (author: tatu.saloranta@iki.fi). This commit is an ancestor of the TuxCare onboarding commit 4da4dfb3381c0d056fc8fbadeb6236b947e4b574, confirming the fix was already present in upstream version 2.15.2 before TuxCare onboarded it. The validation is active in the deserialization path (BeanDeserializerFactory line 141).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability allowed remote code execution via polymorphic deserialization of malicious JSON containing Spring/C3P0/Tomcat gadget classes when bypassing an incomplete blacklist. The target contains the complete fix: SubTypeValidator with comprehensive blacklist (including all CVE-2017-17485 gadgets) and Spring class hierarchy checks, introduced by upstream commit 2235894210 (author: tatu.saloranta@iki.fi). This commit is an ancestor of the TuxCare onboarding commit 4da4dfb3381c0d056fc8fbadeb6236b947e4b574, confirming the fix was already present in upstream version 2.15.2 before TuxCare onboarded it. The validation is active in the deserialization path (BeanDeserializerFactory line 141).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.2-tuxcare.4 is NOT affected by CVE-2017-7525. The vulnerability was fixed in upstream jackson-databind versions 2.6.7.1, 2.7.9.1, and 2.8.9 (released July-April 2017). The defense mechanism that blocks deserialization of dangerous gadget classes was already present in upstream version 2.15.2, which TuxCare onboarded. The fix is implemented in SubTypeValidator.validateSubType() which checks types against a blacklist before deserializer creation. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "Target version 2.15.2-tuxcare.4 is NOT affected by CVE-2017-7525. The vulnerability was fixed in upstream jackson-databind versions 2.6.7.1, 2.7.9.1, and 2.8.9 (released July-April 2017). The defense mechanism that blocks deserialization of dangerous gadget classes was already present in upstream version 2.15.2, which TuxCare onboarded. The fix is implemented in SubTypeValidator.validateSubType() which checks types against a blacklist before deserializer creation. This is an upstream fix by Tatu Saloranta, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is not present in jackson-databind 2.15.2. The vulnerability involves Jackson default typing with the iBatis gadget class org.apache.ibatis.parsing.XPathParser allowing data exfiltration. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 (commit 27b4defc27, May 2018) by adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.15.2, as confirmed by checking the onboarding commit 4da4dfb338. The target version 2.15.2 (released June 2023) inherits the upstream fix. The blacklist entry exists at line 65 of SubTypeValidator.java and prevents deserialization of the gadget class, blocking the attack chain from malicious JSON input to data exfiltration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is not present in jackson-databind 2.15.2. The vulnerability involves Jackson default typing with the iBatis gadget class org.apache.ibatis.parsing.XPathParser allowing data exfiltration. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 (commit 27b4defc27, May 2018) by adding org.apache.ibatis.parsing.XPathParser to the deserialization blacklist in SubTypeValidator.java. This fix was already present when TuxCare onboarded version 2.15.2, as confirmed by checking the onboarding commit 4da4dfb338. The target version 2.15.2 (released June 2023) inherits the upstream fix. The blacklist entry exists at line 65 of SubTypeValidator.java and prevents deserialization of the gadget class, blocking the attack chain from malicious JSON input to data exfiltration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves polymorphic deserialization of dangerous gadget classes (Jodd-db and Oracle JDBC types) that enable JNDI/LDAP-based remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) applied the fix in May-June 2018 by adding these classes to SubTypeValidator's blacklist. The fix was already present in the upstream release 2.15.2 (released May 2023) when TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves polymorphic deserialization of dangerous gadget classes (Jodd-db and Oracle JDBC types) that enable JNDI/LDAP-based remote code execution when Default Typing is enabled. The upstream vendor (FasterXML) applied the fix in May-June 2018 by adding these classes to SubTypeValidator's blacklist. The fix was already present in the upstream release 2.15.2 (released May 2023) when TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 does not affect jackson-databind version 2.15.2-tuxcare.4. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing arbitrary code execution via JNDI/LDAP injection. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 by adding these classes to SubTypeValidator's blacklist. This fix was already present in upstream release 2.15.2, which TuxCare onboarded. The target contains the defense at SubTypeValidator.java lines 67-72, and the validateSubType method actively enforces the blacklist by throwing JsonMappingException for any blacklisted types during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 does not affect jackson-databind version 2.15.2-tuxcare.4. The vulnerability involves polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) when Default Typing is enabled, allowing arbitrary code execution via JNDI/LDAP injection. The upstream vendor (FasterXML) fixed this in version 2.7.9.4 by adding these classes to SubTypeValidator's blacklist. This fix was already present in upstream release 2.15.2, which TuxCare onboarded. The target contains the defense at SubTypeValidator.java lines 67-72, and the validateSubType method actively enforces the blacklist by throwing JsonMappingException for any blacklisted types during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns polymorphic deserialization of the dangerous class org.slf4j.ext.EventData. The upstream vendor (FasterXML) added this class to the deserialization blocklist in commit 87d29af25e (2018-08-16), and this fix was already present in upstream version 2.15.2 when TuxCare onboarded it. The target's SubTypeValidator.java contains the blocklist entry at line 75, and the validation is enforced at runtime via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns polymorphic deserialization of the dangerous class org.slf4j.ext.EventData. The upstream vendor (FasterXML) added this class to the deserialization blocklist in commit 87d29af25e (2018-08-16), and this fix was already present in upstream version 2.15.2 when TuxCare onboarded it. The target's SubTypeValidator.java contains the blocklist entry at line 75, and the validation is enforced at runtime via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for dangerous BlazeDS deserialization gadgets. The target version 2.15.2 contains the upstream fix (commit 87d29af25e) which adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the jackson-databind 2.15.2 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to missing blocklist entries for dangerous BlazeDS deserialization gadgets. The target version 2.15.2 contains the upstream fix (commit 87d29af25e) which adds flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor to the deserialization blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the jackson-databind 2.15.2 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns XXE attacks via polymorphic deserialization of unblocked JDK classes. The upstream fix (commit 87d29af25e by Tatu Saloranta) added four dangerous classes to the deserialization blocklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. These blocklist entries are present in the target at SubTypeValidator.java lines 75-78, preventing the vulnerable deserialization pattern. This fix was already included in upstream version 2.15.2 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns XXE attacks via polymorphic deserialization of unblocked JDK classes. The upstream fix (commit 87d29af25e by Tatu Saloranta) added four dangerous classes to the deserialization blocklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. These blocklist entries are present in the target at SubTypeValidator.java lines 75-78, preventing the vulnerable deserialization pattern. This fix was already included in upstream version 2.15.2 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind 2.x before 2.9.7. The target version 2.15.2-tuxcare.4 already contains the upstream vendor's fix that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and shipped in upstream version 2.9.7. Since the target is version 2.15.2 (much later than 2.9.7), the fix was already present when TuxCare onboarded this version. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind 2.x before 2.9.7. The target version 2.15.2-tuxcare.4 already contains the upstream vendor's fix that blocks org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 87d29af25e and shipped in upstream version 2.9.7. Since the target is version 2.15.2 (much later than 2.9.7), the fix was already present when TuxCare onboarded this version. The vulnerable pattern does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.15.2. The vulnerability affects versions before 2.9.8 and involves missing blacklist protection for the axis2-transport-jms gadget class during polymorphic deserialization. The fix (commit 72cd4025a2) was authored by upstream vendor FasterXML on 2018-11-19, adding \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" to the SubTypeValidator blacklist. This fix was already included in the upstream 2.15.2 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of the onboarding commit 4da4dfb338. The blacklist entry is present at line 85 of SubTypeValidator.java and actively enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.15.2. The vulnerability affects versions before 2.9.8 and involves missing blacklist protection for the axis2-transport-jms gadget class during polymorphic deserialization. The fix (commit 72cd4025a2) was authored by upstream vendor FasterXML on 2018-11-19, adding \"org.apache.axis2.transport.jms.JMSOutTransportInfo\" to the SubTypeValidator blacklist. This fix was already included in the upstream 2.15.2 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of the onboarding commit 4da4dfb338. The blacklist entry is present at line 85 of SubTypeValidator.java and actively enforced by BeanDeserializerFactory during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.15.2) is NOT affected by CVE-2018-19361. The vulnerability required blocking OpenJPA classes from polymorphic deserialization. The upstream fix (commit 72cd4025a) that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the blocklist was already present in the upstream 2.15.2 release. The CVE affects versions \"before 2.9.8\" and the target version 2.15.2 is well beyond the fixed version. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "The target repository (jackson-databind 2.15.2) is NOT affected by CVE-2018-19361. The vulnerability required blocking OpenJPA classes from polymorphic deserialization. The upstream fix (commit 72cd4025a) that adds org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the blocklist was already present in the upstream 2.15.2 release. The CVE affects versions \"before 2.9.8\" and the target version 2.15.2 is well beyond the fixed version. The vulnerable code pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.2-tuxcare.4 is NOT AFFECTED by CVE-2018-19362. The vulnerability involves polymorphic deserialization of malicious gadget classes (specifically org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core). The fix\u2014adding four class names to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java\u2014was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded. CVE-2018-19362 affects \"2.x before 2.9.8\"; version 2.15.2 is well beyond that range. The vulnerable pattern is not present in the target because the upstream vendor (FasterXML) shipped the fix in commit 72cd4025a2 (\"Fix #2186\") authored by Tatu Saloranta, which became part of the 2.15.2 release before TuxCare's onboarding commit 4da4dfb3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "Target jackson-databind 2.15.2-tuxcare.4 is NOT AFFECTED by CVE-2018-19362. The vulnerability involves polymorphic deserialization of malicious gadget classes (specifically org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core). The fix\u2014adding four class names to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java\u2014was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded. CVE-2018-19362 affects \"2.x before 2.9.8\"; version 2.15.2 is well beyond that range. The vulnerable pattern is not present in the target because the upstream vendor (FasterXML) shipped the fix in commit 72cd4025a2 (\"Fix #2186\") authored by Tatu Saloranta, which became part of the 2.15.2 release before TuxCare's onboarding commit 4da4dfb3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 does NOT affect jackson-databind 2.15.2-tuxcare.4. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve remote code execution. The fix, which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta (commit 038b471e2e) and shipped in the upstream 2.15.2 release. TuxCare onboarded this already-fixed version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 does NOT affect jackson-databind 2.15.2-tuxcare.4. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the blacklist to achieve remote code execution. The fix, which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, was authored by upstream maintainer Tatu Saloranta (commit 038b471e2e) and shipped in the upstream 2.15.2 release. TuxCare onboarded this already-fixed version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.15.2. The upstream vendor fix (commit 6799f8f10c by Tatu Saloranta, 2018-02-10) was already included in the upstream 2.15.2 release that TuxCare onboarded. The fix implements pattern-based blocking of c3p0 gadget classes: any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\" is rejected during deserialization, preventing exploitation of ComboPooledDataSource and other c3p0 DataSource variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.15.2. The upstream vendor fix (commit 6799f8f10c by Tatu Saloranta, 2018-02-10) was already included in the upstream 2.15.2 release that TuxCare onboarded. The fix implements pattern-based blocking of c3p0 gadget classes: any class starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\" is rejected during deserialization, preventing exploitation of ComboPooledDataSource and other c3p0 DataSource variants.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability affected versions before 2.9.9 due to missing validation of the com.mysql.cj.jdbc.admin.MiniAdmin class during polymorphic deserialization. The target version 2.15.2 includes the upstream fix (commit dda513bd72 by Tatu Saloranta) that was added in version 2.9.9. The fix adds MiniAdmin to the deserialization blocklist in SubTypeValidator.java (line 88), preventing the gadget class from being instantiated. The validation is integrated into the core deserialization flow via BeanDeserializerFactory and cannot be bypassed. TuxCare onboarded version 2.15.2 with this fix already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability affected versions before 2.9.9 due to missing validation of the com.mysql.cj.jdbc.admin.MiniAdmin class during polymorphic deserialization. The target version 2.15.2 includes the upstream fix (commit dda513bd72 by Tatu Saloranta) that was added in version 2.9.9. The fix adds MiniAdmin to the deserialization blocklist in SubTypeValidator.java (line 88), preventing the gadget class from being instantiated. The validation is integrated into the core deserialization flow via BeanDeserializerFactory and cannot be bypassed. TuxCare onboarded version 2.15.2 with this fix already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blacklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource, enabling polymorphic deserialization attacks. The target version 2.15.2-tuxcare.4 contains the upstream fix (commit c9ef4a10d6) that adds this class to the denial list in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 affects jackson-databind versions before 2.9.9.1 due to missing blacklist entry for ch.qos.logback.core.db.DriverManagerConnectionSource, enabling polymorphic deserialization attacks. The target version 2.15.2-tuxcare.4 contains the upstream fix (commit c9ef4a10d6) that adds this class to the denial list in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled, allowing arbitrary file read via JDOM XSLTransformer class deserialization. The fix blocks org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer from deserialization. Target version 2.15.2-tuxcare.4 contains this fix at lines 93-95 of SubTypeValidator.java. The fix (commit 5f7c69bba0, da...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 affects jackson-databind 2.x through 2.9.9 when Default Typing is enabled, allowing arbitrary file read via JDOM XSLTransformer class deserialization. The fix blocks org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer from deserialization. Target version 2.15.2-tuxcare.4 contains this fix at lines 93-95 of SubTypeValidator.java. The fix (commit 5f7c69bba0, da..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is not present in the target jackson-databind 2.15.2-tuxcare.3. The vulnerability involved missing blocklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator.java, allowing arbitrary code execution via polymorphic type deserialization. The upstream vendor (FasterXML) added these blocklist entries in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b (July 2019), released in versions 2.7.9.6, 2.8.11.4, and 2.9.9.2. The target version 2.15.2 already contained this fix when TuxCare onboarded it, so the vulnerable code pattern never existed in the TuxCare maintenance branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is not present in the target jackson-databind 2.15.2-tuxcare.3. The vulnerability involved missing blocklist entries for net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource in SubTypeValidator.java, allowing arbitrary code execution via polymorphic type deserialization. The upstream vendor (FasterXML) added these blocklist entries in commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b (July 2019), released in versions 2.7.9.6, 2.8.11.4, and 2.9.9.2. The target version 2.15.2 already contained this fix when TuxCare onboarded it, so the vulnerable code pattern never existed in the TuxCare maintenance branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.15.2. The vulnerability involves polymorphic deserialization of the dangerous class ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The fix (adding this class to the deserialization blacklist in SubTypeValidator.java line 102) was introduced by upstream maintainer Tatu Saloranta in commit ad418eeb (July 2019) and shipped in the upstream 2.15.2 release, before TuxCare onboarded this version. The target version is much newer than the affected versions (before 2.9.9.2).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.15.2. The vulnerability involves polymorphic deserialization of the dangerous class ch.qos.logback.core.db.JNDIConnectionSource when Default Typing is enabled. The fix (adding this class to the deserialization blacklist in SubTypeValidator.java line 102) was introduced by upstream maintainer Tatu Saloranta in commit ad418eeb (July 2019) and shipped in the upstream 2.15.2 release, before TuxCare onboarded this version. The target version is much newer than the affected versions (before 2.9.9.2).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.2-tuxcare.4 is NOT vulnerable to CVE-2019-14540. The fix (blacklisting com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource in SubTypeValidator.java) was already present in the upstream 2.15.2 release. The vulnerable pattern does not exist in this version because the upstream vendor (FasterXML) fixed this issue before version 2.9.10, and version 2.15.2 is significantly newer. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "The target repository jackson-databind version 2.15.2-tuxcare.4 is NOT vulnerable to CVE-2019-14540. The fix (blacklisting com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource in SubTypeValidator.java) was already present in the upstream 2.15.2 release. The vulnerable pattern does not exist in this version because the upstream vendor (FasterXML) fixed this issue before version 2.9.10, and version 2.15.2 is significantly newer. The CVE affects versions before 2.9.10, 2.8.11.5, and 2.6.7.3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.15.2-tuxcare.4. The fix was already included in the upstream jackson-databind 2.15.2 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration classes) was removed by upstream commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af authored by Tatu Saloranta, which added these two classes to the deserialization blacklist in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.15.2-tuxcare.4. The fix was already included in the upstream jackson-databind 2.15.2 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration classes) was removed by upstream commit 41b7f9b90149e9d44a65a8261a8deedc7186f6af authored by Tatu Saloranta, which added these two classes to the deserialization blacklist in SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) that enables arbitrary code execution. The fix adds this class to a blocklist in SubTypeValidator.java. This blocklist entry is already present at line 117 of the target, and was shipped in upstream version 2.15.2 (released long after the CVE's affected range of \"before 2.9.10 and 2.10.0\"). The fix was authored by upstream maintainer Tatu Saloranta and included in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget (org.apache.xalan.lib.sql.JNDIConnectionPool) that enables arbitrary code execution. The fix adds this class to a blocklist in SubTypeValidator.java. This blocklist entry is already present at line 117 of the target, and was shipped in upstream version 2.15.2 (released long after the CVE's affected range of \"before 2.9.10 and 2.10.0\"). The fix was authored by upstream maintainer Tatu Saloranta and included in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability relates to polymorphic typing exploitation via com.zaxxer.hikari.HikariDataSource. The fix (blocklist entry for HikariDataSource in SubTypeValidator.java line 107) was already present in upstream release 2.15.2 when TuxCare onboarded this version. Commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db by upstream maintainer Tatu Saloranta added the protection before TuxCare's first commit (4da4dfb3... \"Onboard version 2.15.2\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability relates to polymorphic typing exploitation via com.zaxxer.hikari.HikariDataSource. The fix (blocklist entry for HikariDataSource in SubTypeValidator.java line 107) was already present in upstream release 2.15.2 when TuxCare onboarded this version. Commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db by upstream maintainer Tatu Saloranta added the protection before TuxCare's first commit (4da4dfb3... \"Onboard version 2.15.2\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.15.2-tuxcare.4. The fix for this vulnerability was already included in the upstream jackson-databind 2.15.2 release. The three dangerous commons-dbcp datasource classes (PerUserPoolDataSource, SharedPoolDataSource) and P6DataSource are present in the SubTypeValidator denylist (lines 124-127), preventing their deserialization when Default Typing is enabled. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) in commits 9593e16cf5 and 328a0f833d, both of which were already present when TuxCare onboarded version 2.15.2 in commit 4da4dfb3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.15.2-tuxcare.4. The fix for this vulnerability was already included in the upstream jackson-databind 2.15.2 release. The three dangerous commons-dbcp datasource classes (PerUserPoolDataSource, SharedPoolDataSource) and P6DataSource are present in the SubTypeValidator denylist (lines 124-127), preventing their deserialization when Default Typing is enabled. The fix was authored by Tatu Saloranta (upstream FasterXML maintainer) in commits 9593e16cf5 and 328a0f833d, both of which were already present when TuxCare onboarded version 2.15.2 in commit 4da4dfb3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943: The target jackson-databind 2.15.2 is NOT AFFECTED. The vulnerability involves polymorphic typing deserialization of com.p6spy.engine.spy.P6DataSource leading to remote code execution. The upstream vendor (FasterXML) fixed this in commit 9593e16cf5 by adding P6DataSource to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943: The target jackson-databind 2.15.2 is NOT AFFECTED. The vulnerability involves polymorphic typing deserialization of com.p6spy.engine.spy.P6DataSource leading to remote code execution. The upstream vendor (FasterXML) fixed this in commit 9593e16cf5 by adding P6DataSource to the SubTypeValidator blocklist. This fix was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded, making the vulnerable pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is a polymorphic typing issue in jackson-databind related to the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The vendor patch adds this class to the SubTypeValidator blocklist to prevent its deserialization. In the target (jackson-databind 2.15.2-tuxcare.4), this fix was already present in the upstream release 2.15.2 that TuxCare onboarded (commit 191a4cdf87b by upstream author Tatu Saloranta). The dangerous class is blocked at line 99 of SubTypeValidator.java, and the validation is enforced in the core deserialization path via BeanDeserializerFactory. The target is not affected because the vulnerable pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is a polymorphic typing issue in jackson-databind related to the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The vendor patch adds this class to the SubTypeValidator blocklist to prevent its deserialization. In the target (jackson-databind 2.15.2-tuxcare.4), this fix was already present in the upstream release 2.15.2 that TuxCare onboarded (commit 191a4cdf87b by upstream author Tatu Saloranta). The dangerous class is blocked at line 99 of SubTypeValidator.java, and the validation is enforced in the core deserialization path via BeanDeserializerFactory. The target is not affected because the vulnerable pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind versions before 2.9.10.1, 2.8.11.5, and 2.6.7.3 when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath. The vulnerability allows remote code execution via JNDI exploitation through two log4j-extras classes. The target repository (version 2.15.2-tuxcare.4) is NOT AFFECTED because the upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, authored by Tatu Saloranta on 2019-10-12) was already present in the upstream 2.15.2 release when TuxCare onboarded it. The fix adds org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the SubTypeValidator deserialization blocklist, preventing instantiation of these gadget classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind versions before 2.9.10.1, 2.8.11.5, and 2.6.7.3 when Default Typing is enabled and apache-log4j-extra (1.2.x) is in the classpath. The vulnerability allows remote code execution via JNDI exploitation through two log4j-extras classes. The target repository (version 2.15.2-tuxcare.4) is NOT AFFECTED because the upstream fix (commit b5a304a98590b6bb766134f9261e6566dcbbb6d0, authored by Tatu Saloranta on 2019-10-12) was already present in the upstream 2.15.2 release when TuxCare onboarded it. The fix adds org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource to the SubTypeValidator deserialization blocklist, preventing instantiation of these gadget classes during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The upstream fix (commit eb254813cc by Tatu Saloranta) was already included in the 2.15.2 release before TuxCare onboarded it. The target code contains the required blocklist entries at SubTypeValidator.java lines 134-135, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns missing blocklist entries for two ehcache classes (GenericJndiSelector and GlassfishSelector) that enable JNDI injection attacks. The upstream fix (commit eb254813cc by Tatu Saloranta) was already included in the 2.15.2 release before TuxCare onboarded it. The target code contains the required blocklist entries at SubTypeValidator.java lines 134-135, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta JNDI gadget classes. The target repository (jackson-databind 2.15.2-tuxcare.4) is NOT vulnerable. The fix blocking deserialization of org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider is present at SubTypeValidator.java:157-160. This fix was shipped in upstream version 2.15.2, which TuxCare onboarded, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "CVE-2020-10650 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of ignite-jta JNDI gadget classes. The target repository (jackson-databind 2.15.2-tuxcare.4) is NOT vulnerable. The fix blocking deserialization of org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider is present at SubTypeValidator.java:157-160. This fix was shipped in upstream version 2.15.2, which TuxCare onboarded, making the target safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory gadget class. The target repository (jackson-databind 2.15.2-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in version 2.15.2 before TuxCare onboarding. The fix adds XaPooledConnectionFactory and RecoverablePooledConnectionFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 162-164), preventing polymorphic deserialization of these dangerous classes. This protection was authored by Tatu Saloranta (upstream maintainer) in commit 592872f4235 on 2020-03-15 and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory gadget class. The target repository (jackson-databind 2.15.2-tuxcare.4) is NOT AFFECTED because the upstream vendor fix was already present in version 2.15.2 before TuxCare onboarding. The fix adds XaPooledConnectionFactory and RecoverablePooledConnectionFactory to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (lines 162-164), preventing polymorphic deserialization of these dangerous classes. This protection was authored by Tatu Saloranta (upstream maintainer) in commit 592872f4235 on 2020-03-15 and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, related to deserialization of com.caucho.config.types.ResourceRef gadget class. The target version 2.15.2-tuxcare.4 contains the upstream fix that adds \"com.caucho.config.types.ResourceRef\" to the SubTypeValidator blocklist (line 167 of SubTypeValidator.java). This fix was shipped in the upstream jackson-databind 2.15.2 release and was present when TuxCare onboarded the version. The fix commit (1645efbd392989cf015f459a91c999e59c921b15 by upstream author tatu.saloranta@iki.fi) predates the first TuxCare commit. The blocklist is actively enforced by BeanDeserializerFactory during deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 affects jackson-databind versions before 2.9.10.4, related to deserialization of com.caucho.config.types.ResourceRef gadget class. The target version 2.15.2-tuxcare.4 contains the upstream fix that adds \"com.caucho.config.types.ResourceRef\" to the SubTypeValidator blocklist (line 167 of SubTypeValidator.java). This fix was shipped in the upstream jackson-databind 2.15.2 release and was present when TuxCare onboarded the version. The fix commit (1645efbd392989cf015f459a91c999e59c921b15 by upstream author tatu.saloranta@iki.fi) predates the first TuxCare commit. The blocklist is actively enforced by BeanDeserializerFactory during deserialization, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream vendor (FasterXML) fixed this by adding the dangerous class names to a deny-list in SubTypeValidator.java. This fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 by Tatu Saloranta) was already present in the upstream release 2.15.2 that TuxCare onboarded. The target contains the complete defense at SubTypeValidator.java:170-171, which blocks deserialization of both org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadgets related to org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream vendor (FasterXML) fixed this by adding the dangerous class names to a deny-list in SubTypeValidator.java. This fix (commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 by Tatu Saloranta) was already present in the upstream release 2.15.2 that TuxCare onboarded. The target contains the complete defense at SubTypeValidator.java:170-171, which blocks deserialization of both org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.15.2 is NOT vulnerable to CVE-2020-10969. The CVE affects versions \"2.x before 2.9.10.4\", but version 2.15.2 is significantly newer and contains the upstream fix. The fix (adding \"javax.swing.JEditorPane\" to the deserialization deny list) was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 and was already present in the upstream 2.15.2 release before TuxCare onboarded it. The deny-list check is properly integrated into the deserialization flow via BeanDeserializerFactory and will reject attempts to deserialize JEditorPane, preventing the serialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "Target jackson-databind version 2.15.2 is NOT vulnerable to CVE-2020-10969. The CVE affects versions \"2.x before 2.9.10.4\", but version 2.15.2 is significantly newer and contains the upstream fix. The fix (adding \"javax.swing.JEditorPane\" to the deserialization deny list) was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 4d038c9de0aa80a5dae27f552a975cb39cc42b60 and was already present in the upstream 2.15.2 release before TuxCare onboarded it. The deny-list check is properly integrated into the deserialization flow via BeanDeserializerFactory and will reject attempts to deserialize JEditorPane, preventing the serialization gadget attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.15.2-tuxcare.4, which already contains the upstream fix. The fix was introduced in upstream version 2.9.10.4 by commit c14c9f99ed, which added activemq classes to the SubTypeValidator deny-list. This fix was already present in the upstream 2.15.2 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.15.2-tuxcare.4, which already contains the upstream fix. The fix was introduced in upstream version 2.9.10.4 by commit c14c9f99ed, which added activemq classes to the SubTypeValidator deny-list. This fix was already present in the upstream 2.15.2 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability related to org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository is version 2.15.2-tuxcare.4, which is significantly later than the fixed version. The upstream fix (commit 05d7e0e13f by Tatu Saloranta on 2020-03-25) added the malicious class name to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 186), preventing deserialization of this gadget class. This fix was already present in the upstream release 2.15.2 when TuxCare onboarded it (first TuxCare commit 4da4dfb3381c0d056fc8fbadeb6236b947e4b574). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget vulnerability related to org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository is version 2.15.2-tuxcare.4, which is significantly later than the fixed version. The upstream fix (commit 05d7e0e13f by Tatu Saloranta on 2020-03-25) added the malicious class name to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist (line 186), preventing deserialization of this gadget class. This fix was already present in the upstream release 2.15.2 when TuxCare onboarded it (first TuxCare commit 4da4dfb3381c0d056fc8fbadeb6236b947e4b574). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.2-tuxcare.4 is NOT affected by CVE-2020-11113. The vulnerability relates to Jackson-databind's unsafe deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream vendor (FasterXML) fixed this in commit e2ba12d5d (March 2020) by adding WASRegistryManagedRuntime to the SubTypeValidator blocklist. This fix was included in upstream release 2.9.10.4 and all subsequent versions. The target version 2.15.2 (released much later) ships with the fix already present at SubTypeValidator.java:84. The fix came from upstream, not from TuxCare backporting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "Target version 2.15.2-tuxcare.4 is NOT affected by CVE-2020-11113. The vulnerability relates to Jackson-databind's unsafe deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The upstream vendor (FasterXML) fixed this in commit e2ba12d5d (March 2020) by adding WASRegistryManagedRuntime to the SubTypeValidator blocklist. This fix was included in upstream release 2.9.10.4 and all subsequent versions. The target version 2.15.2 (released much later) ships with the fix already present at SubTypeValidator.java:84. The fix came from upstream, not from TuxCare backporting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves deserialization gadgets in org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.15.2 when TuxCare onboarded the version. The target version (2.15.2) is well beyond the affected range (before 2.9.10.4), and the defensive code is confirmed present at SubTypeValidator.java lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves deserialization gadgets in org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean. The upstream fix (commit 113e89fb08) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in upstream jackson-databind 2.15.2 when TuxCare onboarded the version. The target version (2.15.2) is well beyond the affected range (before 2.9.10.4), and the defensive code is confirmed present at SubTypeValidator.java lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target (jackson-databind 2.15.2-tuxcare.4) is not affected because the fix was already present in the upstream 2.15.2 release that TuxCare onboarded. The dangerous class is blocked at line 189 of SubTypeValidator.java via the DEFAULT_NO_DESER_CLASS_NAMES blocklist, which is enforced during polymorphic deserialization at line 269, throwing an exception that prevents instantiation of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to a deserialization gadget in org.apache.commons.jelly.impl.Embedded. The target (jackson-databind 2.15.2-tuxcare.4) is not affected because the fix was already present in the upstream 2.15.2 release that TuxCare onboarded. The dangerous class is blocked at line 189 of SubTypeValidator.java via the DEFAULT_NO_DESER_CLASS_NAMES blocklist, which is enforced during polymorphic deserialization at line 269, throwing an exception that prevents instantiation of the gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind 2.x before 2.9.10.5 and involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.15.2-tuxcare.4 is NOT vulnerable. The fix (blocklist entries for the dangerous gadget classes) was shipped in the upstream jackson-databind 2.15.2 release by Tatu Saloranta (commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921), which predates the TuxCare onboarding commit (4da4dfb3381c0d056fc8fbadeb6236b947e4b574). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind 2.x before 2.9.10.5 and involves deserialization gadgets related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.15.2-tuxcare.4 is NOT vulnerable. The fix (blocklist entries for the dangerous gadget classes) was shipped in the upstream jackson-databind 2.15.2 release by Tatu Saloranta (commit d1c67a0396e84c08d0558fbb843b5bd1f26e1921), which predates the TuxCare onboarding commit (4da4dfb3381c0d056fc8fbadeb6236b947e4b574). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involved missing blacklist entries for Oracle AQjms JMS connection factory classes that could be exploited as deserialization gadgets. The upstream fix (commit 5c8642aeae by Tatu Saloranta) added five Oracle AQjms classes to the SubTypeValidator blacklist and shipped in jackson-databind 2.15.2 before TuxCare onboarded this version. The blacklist entries are present at SubTypeValidator.java:200-204 and actively enforced at lines 269-303, blocking deserialization of these dangerous classes with the error message \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involved missing blacklist entries for Oracle AQjms JMS connection factory classes that could be exploited as deserialization gadgets. The upstream fix (commit 5c8642aeae by Tatu Saloranta) added five Oracle AQjms classes to the SubTypeValidator blacklist and shipped in jackson-databind 2.15.2 before TuxCare onboarded this version. The blacklist entries are present at SubTypeValidator.java:200-204 and actively enforced at lines 269-303, blocking deserialization of these dangerous classes with the error message \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.2-tuxcare.4 is not affected by CVE-2020-14062. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which could lead to JNDI injection and remote code execution. However, this class is already blacklisted in SubTypeValidator.java (line 119), preventing its deserialization. The fix was introduced by upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 (author: tatu.saloranta@iki.fi) on May 1, 2020, and was part of the upstream 2.15.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "The target repository jackson-databind version 2.15.2-tuxcare.4 is not affected by CVE-2020-14062. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which could lead to JNDI injection and remote code execution. However, this class is already blacklisted in SubTypeValidator.java (line 119), preventing its deserialization. The fix was introduced by upstream commit 840eae2ca81c597a0010b2126f32dce17d384b70 (author: tatu.saloranta@iki.fi) on May 1, 2020, and was part of the upstream 2.15.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.15.2-tuxcare.4 is NOT vulnerable to CVE-2020-14195. The fix blocking deserialization of org.jsecurity.realm.jndi.JndiRealmFactory was already present in the upstream 2.15.2 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "The target repository jackson-databind version 2.15.2-tuxcare.4 is NOT vulnerable to CVE-2020-14195. The fix blocking deserialization of org.jsecurity.realm.jndi.JndiRealmFactory was already present in the upstream 2.15.2 release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:207 and is actively enforced by the validateSubType method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.15.2-tuxcare.4 is NOT affected by CVE-2020-24616. The vulnerability involves unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The fix (adding this class to SubTypeValidator's blocklist) was already present in upstream version 2.15.2 when TuxCare onboarded it. The fix commit (3d97153944) by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit (4da4dfb3), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "Target jackson-databind 2.15.2-tuxcare.4 is NOT affected by CVE-2020-24616. The vulnerability involves unsafe deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource. The fix (adding this class to SubTypeValidator's blocklist) was already present in upstream version 2.15.2 when TuxCare onboarded it. The fix commit (3d97153944) by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit (4da4dfb3), confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability, which allowed deserialization of the dangerous com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class leading to JNDI injection attacks, was fixed in the upstream release. The fix adds this class to Jackson's deserialization blocklist in SubTypeValidator.java at line 210, preventing instantiation during polymorphic deserialization. This fix (commit 6cc9f1a1af) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability, which allowed deserialization of the dangerous com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class leading to JNDI injection attacks, was fixed in the upstream release. The fix adds this class to Jackson's deserialization blocklist in SubTypeValidator.java at line 210, preventing instantiation during polymorphic deserialization. This fix (commit 6cc9f1a1af) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.15.2 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability) is NOT present in jackson-databind 2.15.2-tuxcare.4. The upstream fix (commit 612f971b78 by Tatu Saloranta, 2020-01-09) was already included in the upstream 2.15.2 release that TuxCare onboarded on 2026-09-10. The vulnerable pattern (missing XXE protections) is not present because DOMDeserializer.java contains the required security features: disallow-doctype-decl=true and nonvalidating/load-external-dtd=false at lines 40-46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability) is NOT present in jackson-databind 2.15.2-tuxcare.4. The upstream fix (commit 612f971b78 by Tatu Saloranta, 2020-01-09) was already included in the upstream 2.15.2 release that TuxCare onboarded on 2026-09-10. The vulnerable pattern (missing XXE protections) is not present because DOMDeserializer.java contains the required security features: disallow-doctype-decl=true and nonvalidating/load-external-dtd=false at lines 40-46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 fix is already present in jackson-databind 2.15.2. The vulnerability involved deserialization gadgets org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream patch added these classes to SubTypeValidator's blocklist. This fix shipped in upstream jackson-databind before version 2.15.2 and was present when TuxCare onboarded this version. The blocklist entries exist at SubTypeValidator.java:217-218, and the validation is active by default during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 fix is already present in jackson-databind 2.15.2. The vulnerability involved deserialization gadgets org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream patch added these classes to SubTypeValidator's blocklist. This fix shipped in upstream jackson-databind before version 2.15.2 and was present when TuxCare onboarded this version. The blocklist entries exist at SubTypeValidator.java:217-218, and the validation is active by default during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is not present in jackson-databind 2.15.2-tuxcare.3. The vulnerability concerns deserialization gadgets related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by tatu.saloranta@iki.fi) added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (4da4dfb3381c0d056fc8fbadeb6236b947e4b574 \"Onboard version 2.15.2\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is not present in jackson-databind 2.15.2-tuxcare.3. The vulnerability concerns deserialization gadgets related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by tatu.saloranta@iki.fi) added these classes to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This fix was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (4da4dfb3381c0d056fc8fbadeb6236b947e4b574 \"Onboard version 2.15.2\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization of the dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool which can enable JNDI injection attacks. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) was already included in the upstream 2.15.2 release that TuxCare onboarded. The dangerous class is properly blacklisted in SubTypeValidator.java at line 240, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization of the dangerous gadget class com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool which can enable JNDI injection attacks. The upstream fix (commit 1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84 by Tatu Saloranta) was already included in the upstream 2.15.2 release that TuxCare onboarded. The dangerous class is properly blacklisted in SubTypeValidator.java at line 240, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is not present in jackson-databind 2.15.2. The fix was already included in the upstream 2.15.2 release before TuxCare onboarded it. The vulnerability involved missing blocklist entries for DriverAdapterCPDS gadget classes that could enable deserialization attacks. The fix commit (3ded28aece) added five DriverAdapterCPDS class name patterns to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. All blocklist entries are present and the validation mechanism is properly integrated into the deserialization flow via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is not present in jackson-databind 2.15.2. The fix was already included in the upstream 2.15.2 release before TuxCare onboarded it. The vulnerability involved missing blocklist entries for DriverAdapterCPDS gadget classes that could enable deserialization attacks. The fix commit (3ded28aece) added five DriverAdapterCPDS class name patterns to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. All blocklist entries are present and the validation mechanism is properly integrated into the deserialization flow via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.15.2-tuxcare.4 is not affected by CVE-2020-36180. The fix for this vulnerability (commit 3ded28aece \"Fixed #3004\") was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are properly blocklisted in SubTypeValidator.java at lines 123, 193, 219, 228, and 234, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target repository jackson-databind 2.15.2-tuxcare.4 is not affected by CVE-2020-36180. The fix for this vulnerability (commit 3ded28aece \"Fixed #3004\") was already present in the upstream jackson-databind 2.15.2 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are properly blocklisted in SubTypeValidator.java at lines 123, 193, 219, 228, and 234, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadgets related to DriverAdapterCPDS variants. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added 5 DriverAdapterCPDS class names to the SubTypeValidator blocklist, preventing their deserialization. All 5 entries are present in the target's SubTypeValidator.java. This fix was authored by the upstream maintainer and shipped in the original upstream 2.15.2 release that TuxCare onboarded, not backported by TuxCare for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadgets related to DriverAdapterCPDS variants. The upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta) added 5 DriverAdapterCPDS class names to the SubTypeValidator blocklist, preventing their deserialization. All 5 entries are present in the target's SubTypeValidator.java. This fix was authored by the upstream maintainer and shipped in the original upstream 2.15.2 release that TuxCare onboarded, not backported by TuxCare for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 is not present in jackson-databind 2.15.2-tuxcare.4. The fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b) was already included in upstream release 2.15.2, which TuxCare onboarded. The vulnerable gadget classes (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes) are in the deserialization blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 is not present in jackson-databind 2.15.2-tuxcare.4. The fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b) was already included in upstream release 2.15.2, which TuxCare onboarded. The vulnerable gadget classes (org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes) are in the deserialization blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT VULNERABLE in jackson-databind 2.15.2-tuxcare.4. The fix was already present in the upstream 2.15.2 release that TuxCare onboarded. The dangerous gadget class \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\" is blocklisted in SubTypeValidator.java:243, preventing deserialization attacks. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 12e23c962ff and shipped in the upstream release before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT VULNERABLE in jackson-databind 2.15.2-tuxcare.4. The fix was already present in the upstream 2.15.2 release that TuxCare onboarded. The dangerous gadget class \"org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool\" is blocklisted in SubTypeValidator.java:243, preventing deserialization attacks. The fix was authored by Tatu Saloranta (upstream maintainer) in commit 12e23c962ff and shipped in the upstream release before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8. The target repository is version 2.15.2-tuxcare.3, which is significantly newer than the affected range. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) that blacklists the deserialization gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream 2.15.2 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8. The target repository is version 2.15.2-tuxcare.3, which is significantly newer than the affected range. The upstream fix (commit 567194c53ae91f0a14dc27239afb739b1c10448a by Tatu Saloranta) that blacklists the deserialization gadget classes org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource was already present in the upstream 2.15.2 release before TuxCare onboarding. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.15.2-tuxcare.4 already contains the upstream vendor fix. The dangerous gadget classes `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource` are present in the SubTypeValidator blocklist (lines 235-236), preventing their deserialization during polymorphic type handling. This fix was included in the upstream 2.15.2 release that was onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 affects jackson-databind versions before 2.9.10.8. The target version 2.15.2-tuxcare.4 already contains the upstream vendor fix. The dangerous gadget classes `org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource` and `PerUserPoolDataSource` are present in the SubTypeValidator blocklist (lines 235-236), preventing their deserialization during polymorphic type handling. This fix was included in the upstream 2.15.2 release that was onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream vendor (Tatu Saloranta) fixed this in commit 3e8fa3beea4 (December 2020) by adding these classes to the SubTypeValidator blocklist. This fix shipped in upstream version 2.9.10.8 and is present in all subsequent versions including 2.15.2. The target contains the fix at SubTypeValidator.java:229-230. Since the fix was already in the upstream release that TuxCare onboarded (commit 4da4dfb3381c), this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadgets in org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource. The upstream vendor (Tatu Saloranta) fixed this in commit 3e8fa3beea4 (December 2020) by adding these classes to the SubTypeValidator blocklist. This fix shipped in upstream version 2.9.10.8 and is present in all subsequent versions including 2.15.2. The target contains the fix at SubTypeValidator.java:229-230. Since the fix was already in the upstream release that TuxCare onboarded (commit 4da4dfb3381c), this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 is not present in jackson-databind 2.15.2-tuxcare.4. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1) that adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist was already included in the upstream 2.15.2 release, which predates all TuxCare modifications to this version branch. The vulnerable pattern (unrestricted deserialization of these gadget classes) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 is not present in jackson-databind 2.15.2-tuxcare.4. The upstream fix (commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1) that adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist was already included in the upstream 2.15.2 release, which predates all TuxCare modifications to this version branch. The vulnerable pattern (unrestricted deserialization of these gadget classes) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.15.2-tuxcare.4 is not affected by CVE-2020-36188. The vulnerability was fixed in the upstream release 2.15.2 before TuxCare onboarded it. The fix (commit 33d96c13fe by upstream author Tatu Saloranta) adds the two gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) to jackson-databind's deserialization deny-list in SubTypeValidator.java at lines 223-224. This prevents these classes from being instantiated during polymorphic deserialization, blocking the JNDI injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "The target jackson-databind 2.15.2-tuxcare.4 is not affected by CVE-2020-36188. The vulnerability was fixed in the upstream release 2.15.2 before TuxCare onboarded it. The fix (commit 33d96c13fe by upstream author Tatu Saloranta) adds the two gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) to jackson-databind's deserialization deny-list in SubTypeValidator.java at lines 223-224. This prevents these classes from being instantiated during polymorphic deserialization, blocking the JNDI injection attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8. The target version 2.15.2 already contains the upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by tatu.saloranta@iki.fi) that was shipped in the original upstream release. The fix adds the vulnerable gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 223-224), preventing their instantiation during polymorphic deserialization. This is an upstream fix, not a TuxCare backport, as it predates the TuxCare onboarding commit (4da4dfb3381c0d056fc8fbadeb6236b947e4b574).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8. The target version 2.15.2 already contains the upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by tatu.saloranta@iki.fi) that was shipped in the original upstream release. The fix adds the vulnerable gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource) to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 223-224), preventing their instantiation during polymorphic deserialization. This is an upstream fix, not a TuxCare backport, as it predates the TuxCare onboarding commit (4da4dfb3381c0d056fc8fbadeb6236b947e4b574).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability (unbounded recursive deserialization causing stack overflow from deeply nested JSON) was fixed by upstream Jackson in two ways: (1) jackson-core 2.15.0 introduced StreamReadConstraints.maxNestingDepth() with default limit of 1000, enforced at the parser level; (2) jackson-databind 2.14+ replaced the recursive Vanilla deserializer with UntypedObjectDeserializerNR, using an iterative approach with Scope objects. Both protections were present in upstream release 2.15.2 before TuxCare onboarding commit 4da4dfb3381c0d056fc8fbadeb6236b947e4b574.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.15.2-tuxcare.4. The vulnerability (unbounded recursive deserialization causing stack overflow from deeply nested JSON) was fixed by upstream Jackson in two ways: (1) jackson-core 2.15.0 introduced StreamReadConstraints.maxNestingDepth() with default limit of 1000, enforced at the parser level; (2) jackson-databind 2.14+ replaced the recursive Vanilla deserializer with UntypedObjectDeserializerNR, using an iterative approach with Scope objects. Both protections were present in upstream release 2.15.2 before TuxCare onboarding commit 4da4dfb3381c0d056fc8fbadeb6236b947e4b574.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 affects jackson-databind versions before 2.9.10.2 (and earlier branches). The target version 2.15.2-tuxcare.4 is much newer and already contains the upstream fix (commit 9bb52c7122) that adds org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.15.2 that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 affects jackson-databind versions before 2.9.10.2 (and earlier branches). The target version 2.15.2-tuxcare.4 is much newer and already contains the upstream fix (commit 9bb52c7122) that adds org.apache.xbean.propertyeditor.JndiConverter to the deserialization blocklist in SubTypeValidator.java. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.15.2 that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 affects jackson-databind versions before 2.9.10.4. The target version 2.15.2 already contains the upstream fix that blocklists the dangerous gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix was introduced in upstream commit 9f4e97019fb by Tatu Saloranta on 2020-02-29 and was included in the upstream 2.15.2 release before TuxCare onboarded it. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 affects jackson-databind versions before 2.9.10.4. The target version 2.15.2 already contains the upstream fix that blocklists the dangerous gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The fix was introduced in upstream commit 9f4e97019fb by Tatu Saloranta on 2020-02-29 and was included in the upstream 2.15.2 release before TuxCare onboarded it. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is a deserialization gadget vulnerability affecting jackson-databind versions before 2.9.10.4, related to the JtaTransactionConfig class. The target repository (jackson-databind 2.15.2-tuxcare.4) is not affected because the fix was already included in the upstream 2.15.2 release before TuxCare onboarded it. The required blocklist entry for com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is present at line 144 of SubTypeValidator.java, preventing deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta in commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 (Feb 29, 2020), which predates TuxCare's onboarding of version 2.15.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is a deserialization gadget vulnerability affecting jackson-databind versions before 2.9.10.4, related to the JtaTransactionConfig class. The target repository (jackson-databind 2.15.2-tuxcare.4) is not affected because the fix was already included in the upstream 2.15.2 release before TuxCare onboarded it. The required blocklist entry for com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig is present at line 144 of SubTypeValidator.java, preventing deserialization of this gadget class. The fix was authored by upstream maintainer Tatu Saloranta in commit 9f4e97019fb0dd836533d0b6198c88787e235ae2 (Feb 29, 2020), which predates TuxCare's onboarding of version 2.15.2.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadget chains via the AnterosDBCPConfig class. The fix (blacklisting br.com.anteros.dbcp.AnterosDBCPConfig in SubTypeValidator) was already present in the upstream 2.15.2 release that TuxCare onboarded, committed by upstream maintainer Tatu Saloranta on 2020-02-29 (commit 9f4e97019fb). The target's SubTypeValidator.java line 145 contains the blacklist entry, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability concerns deserialization gadget chains via the AnterosDBCPConfig class. The fix (blacklisting br.com.anteros.dbcp.AnterosDBCPConfig in SubTypeValidator) was already present in the upstream 2.15.2 release that TuxCare onboarded, committed by upstream maintainer Tatu Saloranta on 2020-02-29 (commit 9f4e97019fb). The target's SubTypeValidator.java line 145 contains the blacklist entry, preventing deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves deserialization of javax.swing.JTextPane as a gadget class. The upstream fix (commit 7dbf51bf78, Sep 17, 2020) added JTextPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream 2.15.2 release before TuxCare onboarded it (first TuxCare commit: 4da4dfb3381c0d056fc8fbadeb6236b947e4b574). The fix is authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer, not TuxCare. Current HEAD contains the defense at SubTypeValidator.java:149-151.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.15.2-tuxcare.4. The vulnerability involves deserialization of javax.swing.JTextPane as a gadget class. The upstream fix (commit 7dbf51bf78, Sep 17, 2020) added JTextPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing its deserialization. This fix was already present in the upstream 2.15.2 release before TuxCare onboarded it (first TuxCare commit: 4da4dfb3381c0d056fc8fbadeb6236b947e4b574). The fix is authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream maintainer, not TuxCare. Current HEAD contains the defense at SubTypeValidator.java:149-151.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target version 2.15.2 is not affected by CVE-2021-46877. The vulnerability (unsafe upfront heap allocation based on untrusted serialized length field) was fixed in upstream commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta on 2021-12-03. This fix shipped with the upstream 2.15.2 release, which TuxCare subsequently onboarded. The target code contains the complete defense: LONGEST_EAGER_ALLOC threshold (100k) with incremental reading via ByteArrayBuilder for larger allocations, preventing the DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "Target version 2.15.2 is not affected by CVE-2021-46877. The vulnerability (unsafe upfront heap allocation based on untrusted serialized length field) was fixed in upstream commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta on 2021-12-03. This fix shipped with the upstream 2.15.2 release, which TuxCare subsequently onboarded. The target code contains the complete defense: LONGEST_EAGER_ALLOC threshold (100k) with incremental reading via ByteArrayBuilder for larger allocations, preventing the DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 affects jackson-databind versions 2.4.0-rc1 to 2.12.7.1 and 2.13.x before 2.13.4.2, with fixes released in 2.12.7.1, 2.13.4.2, and 2.14.0. The target version 2.15.2-tuxcare.4 is based on upstream 2.15.2, which already contains the fix from commit d78d00ee7b authored by upstream maintainer Tatu Saloranta. The fix adds nested array depth checks in primitive value deserializers and BeanDeserializer to prevent resource exhaustion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. All affected code paths now reject deeply nested arrays with appropriate error messages. The vulnerable pattern is not present because the upstream fix was included in the 2.15.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 affects jackson-databind versions 2.4.0-rc1 to 2.12.7.1 and 2.13.x before 2.13.4.2, with fixes released in 2.12.7.1, 2.13.4.2, and 2.14.0. The target version 2.15.2-tuxcare.4 is based on upstream 2.15.2, which already contains the fix from commit d78d00ee7b authored by upstream maintainer Tatu Saloranta. The fix adds nested array depth checks in primitive value deserializers and BeanDeserializer to prevent resource exhaustion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. All affected code paths now reject deeply nested arrays with appropriate error messages. The vulnerable pattern is not present because the upstream fix was included in the 2.15.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 (resource exhaustion via deeply nested arrays with UNWRAP_SINGLE_VALUE_ARRAYS) is NOT present in jackson-databind 2.15.2-tuxcare.4. The upstream vendor (FasterXML) fixed this vulnerability in commit 063183589218fec before the 2.15.2 release. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject deeply nested arrays after unwrapping the first level, preventing unbounded recursive deserialization. This defense is present in the target code at lines 638-646 of BeanDeserializer.java. The vulnerable code pattern has been removed by the upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 (resource exhaustion via deeply nested arrays with UNWRAP_SINGLE_VALUE_ARRAYS) is NOT present in jackson-databind 2.15.2-tuxcare.4. The upstream vendor (FasterXML) fixed this vulnerability in commit 063183589218fec before the 2.15.2 release. The fix adds a check in BeanDeserializer._deserializeFromArray() to reject deeply nested arrays after unwrapping the first level, preventing unbounded recursive deserialization. This defense is present in the target code at lines 638-646 of BeanDeserializer.java. The vulnerable code pattern has been removed by the upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.15.2-tuxcare.4 is not affected by CVE-2026-50193. The vulnerability (StackOverflowError when calling toString() on deeply nested JsonNodes) was fixed in upstream version 2.14.0 via commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c. This fix was included in the upstream 2.15.2 release that TuxCare onboarded. The vulnerable recursive serialization pattern ha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.15.2-tuxcare.4 is not affected by CVE-2026-50193. The vulnerability (StackOverflowError when calling toString() on deeply nested JsonNodes) was fixed in upstream version 2.14.0 via commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c. This fix was included in the upstream 2.15.2 release that TuxCare onboarded. The vulnerable recursive serialization pattern ha..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.15.2 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped on constructor parameters, but this feature does not exist in version 2.15.2. The code explicitly rejects this combination with error: \"Cannot define Creator parameter as `@JsonUnwrapped`: combination not yet supported\" (BasicDeserializerFactory.java:1175). The feature was only added later in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.15.2 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped on constructor parameters, but this feature does not exist in version 2.15.2. The code explicitly rejects this combination with error: \"Cannot define Creator parameter as `@JsonUnwrapped`: combination not yet supported\" (BasicDeserializerFactory.java:1175). The feature was only added later in..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:16.933084+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.15.2-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T11:25:09.565441+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.15.2-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}