{
  "@id": "urn:uuid:8622d58a-74b2-4eb2-9378-b53081bb46d5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 65,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:56:10.105856+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.16.0-tuxcare.4 is not affected because the fix was already present in the upstream 2.16.0 release. The vulnerability involved deserialization of malicious gadget classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 classes) to achieve remote code execution. The upstream fix (commit ddfddfba6414 from August 2017) added these classes to a blacklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This blacklist is actively enforced via _validateSubType() during bean deserialization before any class instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 affects jackson-databind versions prior to 2.8.11 and 2.9.4. The target version 2.16.0-tuxcare.4 is not affected because the fix was already present in the upstream 2.16.0 release. The vulnerability involved deserialization of malicious gadget classes (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring/C3P0 classes) to achieve remote code execution. The upstream fix (commit ddfddfba6414 from August 2017) added these classes to a blacklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This blacklist is actively enforced via _validateSubType() during bean deserialization before any class instantiation occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:47:06.064229+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.0-tuxcare.4 is not affected by CVE-2017-17485. The vulnerability's fix (databind issues #1737 and #1855) shipped in the upstream 2.16.0 release that TuxCare onboarded. The SubTypeValidator class implements comprehensive blacklist checking and pattern-matching logic that blocks all dangerous gadget classes exploited in CVE-2017-17485, including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes (AbstractPointcutAdvisor/AbstractApplicationContext subclasses), C3P0 DataSource classes, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, and com.sun.org.apache.bcel.internal.util.ClassLoader. The fix was authored by upstream maintainers (tatu.saloranta@iki.fi) and integrated before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "The target jackson-databind 2.16.0-tuxcare.4 is not affected by CVE-2017-17485. The vulnerability's fix (databind issues #1737 and #1855) shipped in the upstream 2.16.0 release that TuxCare onboarded. The SubTypeValidator class implements comprehensive blacklist checking and pattern-matching logic that blocks all dangerous gadget classes exploited in CVE-2017-17485, including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, Spring framework classes (AbstractPointcutAdvisor/AbstractApplicationContext subclasses), C3P0 DataSource classes, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, and com.sun.org.apache.bcel.internal.util.ClassLoader. The fix was authored by upstream maintainers (tatu.saloranta@iki.fi) and integrated before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:32:37.942271+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability, which allowed arbitrary code execution through unsafe deserialization of attacker-specified classes when polymorphic typing is enabled, was fixed in the upstream Jackson 2.16.0 release. The fix implements a blacklist-based validation mechanism through SubTypeValidator that rejects known-dangerous classes (TemplatesImpl, InvokerTransformer, etc.) before deserializer creation. This defense was already present when TuxCare onboarded version 2.16.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability, which allowed arbitrary code execution through unsafe deserialization of attacker-specified classes when polymorphic typing is enabled, was fixed in the upstream Jackson 2.16.0 release. The fix implements a blacklist-based validation mechanism through SubTypeValidator that rejects known-dangerous classes (TemplatesImpl, InvokerTransformer, etc.) before deserializer creation. This defense was already present when TuxCare onboarded version 2.16.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:23:14.873847+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5 and was fixed in versions 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind 2.16.0-tuxcare.4, which is significantly newer than the affected versions. The fix (blacklist entry for org.apache.ibatis.parsing.XPathParser) is present in SubTypeValidator.java at line 65. This fix was shipped in the upstream 2.16.0 release and was already present when TuxCare onboarded the version. The fix commit (27b4defc270454dea6842bd9279f17387eceb737) was authored by the upstream maintainer Tatu Saloranta and is an ancestor of the onboarding commit. Therefore, the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind versions 2.0.0 through 2.9.5 and was fixed in versions 2.7.9.4, 2.8.11.2, and 2.9.6. The target repository is jackson-databind 2.16.0-tuxcare.4, which is significantly newer than the affected versions. The fix (blacklist entry for org.apache.ibatis.parsing.XPathParser) is present in SubTypeValidator.java at line 65. This fix was shipped in the upstream 2.16.0 release and was already present when TuxCare onboarded the version. The fix commit (27b4defc270454dea6842bd9279f17387eceb737) was authored by the upstream maintainer Tatu Saloranta and is an ancestor of the onboarding commit. Therefore, the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 does not affect jackson-databind 2.16.0. The vulnerability was fixed in upstream version 2.7.9.4 (June 2018) by adding three gadget classes to the deserialization blacklist in SubTypeValidator.java. Version 2.16.0, released years later, includes this fix. The blacklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet are present and enforced.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 does not affect jackson-databind 2.16.0. The vulnerability was fixed in upstream version 2.7.9.4 (June 2018) by adding three gadget classes to the deserialization blacklist in SubTypeValidator.java. Version 2.16.0, released years later, includes this fix. The blacklist entries for jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet are present and enforced.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:24:15.830231+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is NOT present in jackson-databind 2.16.0. The Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are blacklisted in SubTypeValidator.java, preventing polymorphic deserialization attacks. This fix was already present in upstream version 2.16.0 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is NOT present in jackson-databind 2.16.0. The Oracle JDBC gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are blacklisted in SubTypeValidator.java, preventing polymorphic deserialization attacks. This fix was already present in upstream version 2.16.0 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The vulnerability involves polymorphic deserialization of org.slf4j.ext.EventData leading to arbitrary code execution. The fix (adding org.slf4j.ext.EventData to the deserialization blocklist) was applied by upstream Jackson author Tatu Saloranta in commit 87d29af25e and shipped in the upstream 2.16.0 release before TuxCare onboarded it. The blocklist entry is present in SubTypeValidator.java line 75 and actively prevents deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "Target version 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2018-14718. The vulnerability involves polymorphic deserialization of org.slf4j.ext.EventData leading to arbitrary code execution. The fix (adding org.slf4j.ext.EventData to the deserialization blocklist) was applied by upstream Jackson author Tatu Saloranta in commit 87d29af25e and shipped in the upstream 2.16.0 release before TuxCare onboarded it. The blocklist entry is present in SubTypeValidator.java line 75 and actively prevents deserialization of the dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T11:09:30.137740+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 no evidence captured",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "not_affected \u2014 no evidence captured"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:10:01.555768+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involved four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks or code execution via polymorphic deserialization. The upstream vendor fix (commit 87d29af25e) added these classes to a blocklist. This fix was already present in the upstream release 2.16.0 that TuxCare onboarded. The target contains the fix in SubTypeValidator.java (lines 75-78), though the architecture differs from the patch version (2.6.7.2 had the blocklist in BeanDeserializerFactory.java, while 2.16.0 refactored it into a dedicated SubTypeValidator class). The defense is active and cannot be bypassed\u2014it's invoked during core deserialization at BeanDeserializerFactory.java:141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involved four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable XXE attacks or code execution via polymorphic deserialization. The upstream vendor fix (commit 87d29af25e) added these classes to a blocklist. This fix was already present in the upstream release 2.16.0 that TuxCare onboarded. The target contains the fix in SubTypeValidator.java (lines 75-78), though the architecture differs from the patch version (2.6.7.2 had the blocklist in BeanDeserializerFactory.java, while 2.16.0 refactored it into a dedicated SubTypeValidator class). The defense is active and cannot be bypassed\u2014it's invoked during core deserialization at BeanDeserializerFactory.java:141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:31.077655+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, which could enable SSRF attacks via polymorphic deserialization. The target (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the upstream vendor fix (commit 87d29af25e by Tatu Saloranta) was already included in the 2.16.0 release that TuxCare onboarded. The dangerous class is present in the blocklist at SubTypeValidator.java:78 and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 affects jackson-databind versions before 2.9.7 due to missing blocklist entry for org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl, which could enable SSRF attacks via polymorphic deserialization. The target (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the upstream vendor fix (commit 87d29af25e by Tatu Saloranta) was already included in the 2.16.0 release that TuxCare onboarded. The dangerous class is present in the blocklist at SubTypeValidator.java:78 and is actively enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8, allowing polymorphic deserialization of the dangerous class `org.apache.axis2.transport.jms.JMSOutTransportInfo`. The target repository is jackson-databind version 2.16.0-tuxcare.3. The fix (adding the axis2 class to the deserialization blocklist in SubTypeValidator.java line 85) was already present in the upstream 2.16.0 release before TuxCare onboarded it. The fix commit 72cd4025a2 by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit 0a101b88. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8, allowing polymorphic deserialization of the dangerous class `org.apache.axis2.transport.jms.JMSOutTransportInfo`. The target repository is jackson-databind version 2.16.0-tuxcare.3. The fix (adding the axis2 class to the deserialization blocklist in SubTypeValidator.java line 85) was already present in the upstream 2.16.0 release before TuxCare onboarded it. The fix commit 72cd4025a2 by upstream maintainer Tatu Saloranta is an ancestor of the first TuxCare commit 0a101b88. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:01:04.850496+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 and concerns the failure to block openjpa classes from polymorphic deserialization. The target repository (jackson-databind 2.16.0-tuxcare.4) is not affected because the vulnerable code pattern is absent - the fix was already present in upstream version 2.16.0. The openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are correctly blocked in the SubTypeValidator at lines 82-83, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 and concerns the failure to block openjpa classes from polymorphic deserialization. The target repository (jackson-databind 2.16.0-tuxcare.4) is not affected because the vulnerable code pattern is absent - the fix was already present in upstream version 2.16.0. The openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) are correctly blocked in the SubTypeValidator at lines 82-83, preventing their deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:27:45.237635+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.16.0. The vulnerability affects jackson-databind versions before 2.9.8 due to missing blacklist entries for dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others) in polymorphic deserialization. The target version 2.16.0 already contains the upstream fix from commit 72cd4025a229fb28ec133235003dd4616f70afaa (authored by Tatu Saloranta on 2018-11-19), which was included in the upstream release before TuxCare onboarded it. The fix adds these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.16.0. The vulnerability affects jackson-databind versions before 2.9.8 due to missing blacklist entries for dangerous classes (org.jboss.util.propertyeditor.DocumentEditor and others) in polymorphic deserialization. The target version 2.16.0 already contains the upstream fix from commit 72cd4025a229fb28ec133235003dd4616f70afaa (authored by Tatu Saloranta on 2018-11-19), which was included in the upstream release before TuxCare onboarded it. The fix adds these classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, allowing unauthenticated RCE via two gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.16.0-tuxcare.4 is NOT AFFECTED because the upstream fix (commit 038b471e2e from January 2018, issue #1899) was already present in the upstream release 2.16.0 that TuxCare onboarded. The two gadget classes are blacklisted in SubTypeValidator.java lines 62-63, and this blacklist is enforced during deserialization at line 269, called from BeanDeserializerFactory line 1032. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 affects jackson-databind through 2.8.11 and 2.9.x through 2.9.3, allowing unauthenticated RCE via two gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypass the blacklist. The target version 2.16.0-tuxcare.4 is NOT AFFECTED because the upstream fix (commit 038b471e2e from January 2018, issue #1899) was already present in the upstream release 2.16.0 that TuxCare onboarded. The two gadget classes are blacklisted in SubTypeValidator.java lines 62-63, and this blacklist is enforced during deserialization at line 269, called from BeanDeserializerFactory line 1032. The vulnerable pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:11.067776+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerns incomplete blacklist validation for c3p0 gadgets in polymorphic deserialization. The fix (commit 6799f8f10c by Tatu Saloranta) that blocks com.mchange.v2.c3p0.*DataSource classes was already included in the upstream release 2.16.0 when TuxCare onboarded it. The target code contains the complete c3p0 DataSource blocking logic in SubTypeValidator.java (lines 24, 288-297), preventing exploitation of this deserialization vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerns incomplete blacklist validation for c3p0 gadgets in polymorphic deserialization. The fix (commit 6799f8f10c by Tatu Saloranta) that blocks com.mchange.v2.c3p0.*DataSource classes was already included in the upstream release 2.16.0 when TuxCare onboarded it. The target code contains the complete c3p0 DataSource blocking logic in SubTypeValidator.java (lines 24, 288-297), preventing exploitation of this deserialization vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:36:34.248507+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.16.0 is not affected by CVE-2019-12086. The upstream fix (adding com.mysql.cj.jdbc.admin.MiniAdmin to the deserialization blocklist) was introduced in jackson-databind 2.9.9 (May 2019) and is present in the target's SubTypeValidator at line 88. The fix was shipped in the upstream 2.16.0 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta, not added by TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "Target version 2.16.0 is not affected by CVE-2019-12086. The upstream fix (adding com.mysql.cj.jdbc.admin.MiniAdmin to the deserialization blocklist) was introduced in jackson-databind 2.9.9 (May 2019) and is present in the target's SubTypeValidator at line 88. The fix was shipped in the upstream 2.16.0 release that TuxCare onboarded, authored by upstream maintainer Tatu Saloranta, not added by TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T18:46:56.614471+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 addresses a polymorphic deserialization vulnerability in jackson-databind allowing RCE via the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The fix adds this class to a blocklist in SubTypeValidator to prevent its deserialization. Analysis confirms the fix (commit c9ef4a10d6) is present in the target repository at SubTypeValidator.java line 91. This fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 addresses a polymorphic deserialization vulnerability in jackson-databind allowing RCE via the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource. The fix adds this class to a blocklist in SubTypeValidator to prevent its deserialization. Analysis confirms the fix (commit c9ef4a10d6) is present in the target repository at SubTypeValidator.java line 91. This fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T07:26:00.079403+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository jackson-databind 2.16.0-tuxcare.4 is NOT affected by CVE-2019-12814. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The upstream fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the SubTypeValidator blocklist, preventing their instantiation during deseri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-databind 2.16.0-tuxcare.4 is NOT affected by CVE-2019-12814. The vulnerability involves polymorphic deserialization of JDOM XSLTransformer classes to read arbitrary files. The upstream fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the SubTypeValidator blocklist, preventing their instantiation during deseri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.16.0. The vulnerability involves deserialization of the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled, leading to remote code execution. The fix (commit ad418eeb97) adds this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was already present in upstream jackson-databind 2.16.0 when TuxCare onboarded it. The blacklisted class appears at SubTypeValidator.java:98 and is actively enforced by BeanDeserializerFactory during deserialization. Author: Tatu Saloranta (upstream maintainer), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.16.0. The vulnerability involves deserialization of the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled, leading to remote code execution. The fix (commit ad418eeb97) adds this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist. This fix was already present in upstream jackson-databind 2.16.0 when TuxCare onboarded it. The blacklisted class appears at SubTypeValidator.java:98 and is actively enforced by BeanDeserializerFactory during deserialization. Author: Tatu Saloranta (upstream maintainer), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:43.996674+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves polymorphic deserialization of the dangerous class ch.qos.logback.core.db.JNDIConnectionSource, which can lead to JNDI injection and remote code execution when Default Typing is enabled. The fix (blacklisting this class in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commit ad418eeb97 and shipped in jackson-databind 2.9.9.2 and later versions. The target version 2.16.0 already contained this fix in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves polymorphic deserialization of the dangerous class ch.qos.logback.core.db.JNDIConnectionSource, which can lead to JNDI injection and remote code execution when Default Typing is enabled. The fix (blacklisting this class in SubTypeValidator) was applied by upstream maintainer Tatu Saloranta in commit ad418eeb97 and shipped in jackson-databind 2.9.9.2 and later versions. The target version 2.16.0 already contained this fix in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:51:09.392901+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic typing issues with com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT affected because the fix was already present in the upstream release 2.16.0 that TuxCare onboarded. Both HikariConfig and HikariDataSource are properly blocked in the DEFAULT_NO_DESER_CLASS_NAMES list in SubTypeValidator.java (lines 105, 107).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to polymorphic typing issues with com.zaxxer.hikari.HikariConfig and HikariDataSource. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT affected because the fix was already present in the upstream release 2.16.0 that TuxCare onboarded. Both HikariConfig and HikariDataSource are properly blocked in the DEFAULT_NO_DESER_CLASS_NAMES list in SubTypeValidator.java (lines 105, 107).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:58:58.868131+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2019-14892. The vulnerability involves polymorphic deserialization of malicious commons-configuration JNDIConfiguration classes that enable arbitrary code execution. The fix (blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in the upstream release 2.16.0, which TuxCare onboarded. The fix commit (41b7f9b901) was authored by tatu.saloranta@iki.fi and is an ancestor of the first TuxCare commit. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "The target jackson-databind version 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2019-14892. The vulnerability involves polymorphic deserialization of malicious commons-configuration JNDIConfiguration classes that enable arbitrary code execution. The fix (blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration) was already present in the upstream release 2.16.0, which TuxCare onboarded. The fix commit (41b7f9b901) was authored by tatu.saloranta@iki.fi and is an ancestor of the first TuxCare commit. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 (xalan JNDI gadget deserialization vulnerability) is NOT present in jackson-databind 2.16.0-tuxcare.4. The fix (commit 998efd7082) that blacklists org.apache.xalan.lib.sql.JNDIConnectionPool was already included in the upstream 2.16.0 release when TuxCare onboarded it. The defensive code is verified present in SubTypeValidator.java at line 117.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 (xalan JNDI gadget deserialization vulnerability) is NOT present in jackson-databind 2.16.0-tuxcare.4. The fix (commit 998efd7082) that blacklists org.apache.xalan.lib.sql.JNDIConnectionPool was already included in the upstream 2.16.0 release when TuxCare onboarded it. The defensive code is verified present in SubTypeValidator.java at line 117.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:06.581572+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.0-tuxcare.4) is not affected by CVE-2019-16335. The upstream fix that adds com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blacklist was already present in version 2.16.0 before TuxCare onboarded it. The fix prevents polymorphic deserialization of HikariDataSource, blocking the code execution vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "The target repository (jackson-databind 2.16.0-tuxcare.4) is not affected by CVE-2019-16335. The upstream fix that adds com.zaxxer.hikari.HikariDataSource to the SubTypeValidator blacklist was already present in version 2.16.0 before TuxCare onboarded it. The fix prevents polymorphic deserialization of HikariDataSource, blocking the code execution vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:10.548488+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerns polymorphic deserialization of commons-dbcp datasource classes (SharedPoolDataSource, PerUserPoolDataSource) and P6DataSource when Default Typing is enabled. The fix, which adds these class names to a blocklist in SubTypeValidator.java (lines 124-127), was applied by upstream author Tatu Saloranta (commit 9593e16cf5) and was already present in the upstream 2.16.0 release when TuxCare onboarded it (commit 0a101b8833). The defense mechanism prevents deserialization of these dangerous classes by checking against DEFAULT_NO_DESER_CLASS_NAMES during BeanDeserializerFactory processing and throwing JsonMappingException if matched.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerns polymorphic deserialization of commons-dbcp datasource classes (SharedPoolDataSource, PerUserPoolDataSource) and P6DataSource when Default Typing is enabled. The fix, which adds these class names to a blocklist in SubTypeValidator.java (lines 124-127), was applied by upstream author Tatu Saloranta (commit 9593e16cf5) and was already present in the upstream 2.16.0 release when TuxCare onboarded it (commit 0a101b8833). The defense mechanism prevents deserialization of these dangerous classes by checking against DEFAULT_NO_DESER_CLASS_NAMES during BeanDeserializerFactory processing and throwing JsonMappingException if matched.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:19:24.126381+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involved deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) when polymorphic typing is enabled. The fix, which adds these classes to the SubTypeValidator blocklist, was committed by upstream maintainer Tatu Saloranta on 2019-09-28 (commit 9593e16cf5) and was already present in jackson-databind 2.16.0 when TuxCare onboarded it on 2026-09-20. The defense is actively enforced during bean deserialization via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involved deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp datasources) when polymorphic typing is enabled. The fix, which adds these classes to the SubTypeValidator blocklist, was committed by upstream maintainer Tatu Saloranta on 2019-09-28 (commit 9593e16cf5) and was already present in jackson-databind 2.16.0 when TuxCare onboarded it on 2026-09-20. The defense is actively enforced during bean deserialization via SubTypeValidator.validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87) added this class to SubTypeValidator's denylist at line 99, blocking its deserialization. This fix shipped in upstream version 2.9.10 (Sep 2019) and was already present in version 2.16.0 before TuxCare onboarded it. The validation is enforced unconditionally during bean deserialization via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "Target jackson-databind 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87) added this class to SubTypeValidator's denylist at line 99, blocking its deserialization. This fix shipped in upstream version 2.9.10 (Sep 2019) and was already present in version 2.16.0 before TuxCare onboarded it. The validation is enforced unconditionally during bean deserialization via BeanDeserializerFactory line 141.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:50:46.310411+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 is NOT present in jackson-databind 2.16.0-tuxcare.4. The fix for this polymorphic deserialization vulnerability (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) was already included in upstream version 2.16.0 via commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta on 2019-10-12. The blocklist entries are present in SubTypeValidator.java lines 129-131 and are enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 is NOT present in jackson-databind 2.16.0-tuxcare.4. The fix for this polymorphic deserialization vulnerability (blocking org.apache.log4j.receivers.db.DriverManagerConnectionSource and JNDIConnectionSource) was already included in upstream version 2.16.0 via commit b5a304a98590b6bb766134f9261e6566dcbbb6d0 by Tatu Saloranta on 2019-10-12. The blocklist entries are present in SubTypeValidator.java lines 129-131 and are enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.16.0-tuxcare.4 is NOT affected by CVE-2019-20330. The vulnerability concerns missing blocklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable deserialization-based remote code execution. The upstream fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883 and was already present in the upstream 2.16.0 release before TuxCare onboarded it. The fix adds the two ehcache classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java (lines 133-135), preventing their deserialization. Since the fix was shipped by the upstream vendor and not backported by TuxCare, the verdict is not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "The target repository jackson-databind version 2.16.0-tuxcare.4 is NOT affected by CVE-2019-20330. The vulnerability concerns missing blocklist entries for two net.sf.ehcache classes (GenericJndiSelector and GlassfishSelector) that could enable deserialization-based remote code execution. The upstream fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883 and was already present in the upstream 2.16.0 release before TuxCare onboarded it. The fix adds the two ehcache classes to DEFAULT_NO_DESER_CLASS_NAMES in SubTypeValidator.java (lines 133-135), preventing their deserialization. Since the fix was shipped by the upstream vendor and not backported by TuxCare, the verdict is not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:57.029053+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT affected by CVE-2020-10650. The vulnerability concerns unsafe deserialization of ignite-jta classes. The upstream vendor (Tatu Saloranta) fixed this in commit a424c038ba (2020-03-15) by adding three ignite-jta class names to the deserialization deny-list in SubTypeValidator.java. This fix was already present in upstream version 2.16.0 when TuxCare onboarded it (2026-09-20), making it an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT affected by CVE-2020-10650. The vulnerability concerns unsafe deserialization of ignite-jta classes. The upstream vendor (Tatu Saloranta) fixed this in commit a424c038ba (2020-03-15) by adding three ignite-jta class names to the deserialization deny-list in SubTypeValidator.java. This fix was already present in upstream version 2.16.0 when TuxCare onboarded it (2026-09-20), making it an upstream fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 fix is already present in the target. The blocklist entries for org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory were added in upstream commit 592872f4 (March 2020) and shipped with the upstream 2.16.0 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 fix is already present in the target. The blocklist entries for org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory were added in upstream commit 592872f4 (March 2020) and shipped with the upstream 2.16.0 release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:31:30.745035+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.0-tuxcare.4 is not affected by CVE-2020-10673. The fix (blocklist entry for com.caucho.config.types.ResourceRef) was already present in the upstream Jackson 2.16.0 release, authored by Tatu Saloranta. The SubTypeValidator blocks deserialization of this dangerous gadget class at line 167, and the validator is always active in the deserialization path (BeanDeserializerFactory line 1032). This is an upstream fix that shipped with the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target jackson-databind 2.16.0-tuxcare.4 is not affected by CVE-2020-10673. The fix (blocklist entry for com.caucho.config.types.ResourceRef) was already present in the upstream Jackson 2.16.0 release, authored by Tatu Saloranta. The SubTypeValidator blocks deserialization of this dangerous gadget class at line 167, and the validator is always active in the deserialization path (BeanDeserializerFactory line 1032). This is an upstream fix that shipped with the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 does not affect this target. The vulnerability concerns jackson-databind versions before 2.9.10.4 that allowed deserialization of the dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target is jackson-databind 2.16.0-tuxcare.4, which already includes the upstream fix that was released in version 2.9.10.4 (March 2020). The fix adds org.aoju.bus.proxy.provider.remoting.RmiProvider to the deserialization blocklist in SubTypeValidator.java (lines 169-171), preventing instantiation of this dangerous class. This fix was authored by Tatu Saloranta, the upstream jackson-databind maintainer, and was already present in the upstream 2.16.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 does not affect this target. The vulnerability concerns jackson-databind versions before 2.9.10.4 that allowed deserialization of the dangerous gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The target is jackson-databind 2.16.0-tuxcare.4, which already includes the upstream fix that was released in version 2.9.10.4 (March 2020). The fix adds org.aoju.bus.proxy.provider.remoting.RmiProvider to the deserialization blocklist in SubTypeValidator.java (lines 169-171), preventing instantiation of this dangerous class. This fix was authored by Tatu Saloranta, the upstream jackson-databind maintainer, and was already present in the upstream 2.16.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 is NOT present in jackson-databind 2.16.0. The vulnerability involved unsafe deserialization of javax.swing.JEditorPane, which could enable gadget chain exploitation. The upstream vendor (FasterXML) fixed this in commit 4d038c9de0 by adding javax.swing.JEditorPane to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES). This fix was already present in upstream release 2.16.0 before TuxCare onboarded it. The target's SubTypeValidator.java (line 150) contains the blocklist entry that prevents deserialization of this class, throwing a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\" when attempted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 is NOT present in jackson-databind 2.16.0. The vulnerability involved unsafe deserialization of javax.swing.JEditorPane, which could enable gadget chain exploitation. The upstream vendor (FasterXML) fixed this in commit 4d038c9de0 by adding javax.swing.JEditorPane to the SubTypeValidator blocklist (DEFAULT_NO_DESER_CLASS_NAMES). This fix was already present in upstream release 2.16.0 before TuxCare onboarded it. The target's SubTypeValidator.java (line 150) contains the blocklist entry that prevents deserialization of this class, throwing a JsonMappingException with \"Illegal type to deserialize: prevented for security reasons\" when attempted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is NOT present in jackson-databind 2.16.0. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The target already contains the upstream fix: all 9 activemq classes are blocklisted in SubTypeValidator.java (lines 175-183), preventing their deserialization. This fix was shipped in the upstream 2.16.0 release, which is much newer than the affected versions (before 2.9.10.4). The fix commit c14c9f99 by Tatu Saloranta was already present when TuxCare onboarded version 2.16.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is NOT present in jackson-databind 2.16.0. The vulnerability involves deserialization gadgets using org.apache.activemq.* classes. The target already contains the upstream fix: all 9 activemq classes are blocklisted in SubTypeValidator.java (lines 175-183), preventing their deserialization. This fix was shipped in the upstream 2.16.0 release, which is much newer than the affected versions (before 2.9.10.4). The fix commit c14c9f99 by Tatu Saloranta was already present when TuxCare onboarded version 2.16.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 concerns unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability before TuxCare onboarded version 2.16.0. The fix commit (05d7e0e13f by Tatu Saloranta) added the dangerous class to the deny-list in SubTypeValidator.java line 186, preventing deserialization attacks. This defense is active in the production deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 concerns unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability before TuxCare onboarded version 2.16.0. The fix commit (05d7e0e13f by Tatu Saloranta) added the dangerous class to the deny-list in SubTypeValidator.java line 186, preventing deserialization attacks. This defense is active in the production deserialization path via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.16.0-tuxcare.4) is NOT affected by CVE-2020-11113. The vulnerability involves unsafe deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was already present in upstream version 2.16.0 when TuxCare onboarded it. The fix commit (e2ba12d5d60715d95105e3e790fc234cfb59893d) by upstream maintainer Tatu Saloranta predates the first TuxCare commit (0a101b883317967594e4a1137100ab704c2b0560 \"Onboard version 2.16.0\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target (jackson-databind 2.16.0-tuxcare.4) is NOT affected by CVE-2020-11113. The vulnerability involves unsafe deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime gadget class. The fix (adding this class to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was already present in upstream version 2.16.0 when TuxCare onboarded it. The fix commit (e2ba12d5d60715d95105e3e790fc234cfb59893d) by upstream maintainer Tatu Saloranta predates the first TuxCare commit (0a101b883317967594e4a1137100ab704c2b0560 \"Onboard version 2.16.0\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.0-tuxcare.4 is not affected by CVE-2020-11619. The vulnerability (deserialization gadget via org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) was fixed in upstream commit 113e89fb08 (April 2020), which was already present in the upstream version 2.16.0 when TuxCare onboarded it in September 2026. The fix adds both classes to the SubTypeValidator blocklist, preventing their deserialization through Jackson's polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "The target jackson-databind version 2.16.0-tuxcare.4 is not affected by CVE-2020-11619. The vulnerability (deserialization gadget via org.springframework.aop.config.MethodLocatingFactoryBean and org.springframework.beans.factory.config.BeanReferenceFactoryBean) was fixed in upstream commit 113e89fb08 (April 2020), which was already present in the upstream version 2.16.0 when TuxCare onboarded it in September 2026. The fix adds both classes to the SubTypeValidator blocklist, preventing their deserialization through Jackson's polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:24:45.618566+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in commit 77040d85e3 by adding the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was included in the upstream 2.16.0 release that TuxCare subsequently onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.apache.commons.jelly.impl.Embedded. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT affected because the upstream vendor (FasterXML) already fixed this vulnerability in commit 77040d85e3 by adding the dangerous class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was included in the upstream 2.16.0 release that TuxCare subsequently onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.16.0. The vulnerability required the absence of specific blacklist entries in SubTypeValidator that prevent deserialization of dangerous gadget classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes). These blacklist entries are present in the target at SubTypeValidator.java:192-195. The fix was authored by upstream maintainer Tatu Saloranta in April 2020 (commit d1c67a0396) and was already included in the upstream jackson-databind 2.16.0 release that TuxCare onboarded in September 2026. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.16.0. The vulnerability required the absence of specific blacklist entries in SubTypeValidator that prevent deserialization of dangerous gadget classes (oadd.org.apache.xalan.lib.sql.JNDIConnectionPool and related classes). These blacklist entries are present in the target at SubTypeValidator.java:192-195. The fix was authored by upstream maintainer Tatu Saloranta in April 2020 (commit d1c67a0396) and was already included in the upstream jackson-databind 2.16.0 release that TuxCare onboarded in September 2026. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.16.0-tuxcare.4. The fix blocking deserialization of Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, and AQjmsXAConnectionFactory) was already included in the upstream jackson-databind 2.16.0 release that TuxCare onboarded. All five classes are present in the SubTypeValidator blocklist at lines 200-204, preventing exploitation of this deserialization gadget vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.16.0-tuxcare.4. The fix blocking deserialization of Oracle JMS gadget classes (oracle.jms.AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, and AQjmsXAConnectionFactory) was already included in the upstream jackson-databind 2.16.0 release that TuxCare onboarded. All five classes are present in the SubTypeValidator blocklist at lines 200-204, preventing exploitation of this deserialization gadget vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.16.0-tuxcare.4 is significantly newer and already contains the upstream fix. The dangerous class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is blocklisted in SubTypeValidator.java at line 119, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 840eae2ca81c597a0010b2126f32dce17d384b70, May 2020) and shipped in the upstream 2.16.0 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5. The target version 2.16.0-tuxcare.4 is significantly newer and already contains the upstream fix. The dangerous class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool is blocklisted in SubTypeValidator.java at line 119, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta (commit 840eae2ca81c597a0010b2126f32dce17d384b70, May 2020) and shipped in the upstream 2.16.0 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class to achieve code execution. The fix, which adds this class to the SubTypeValidator blocklist, was implemented by upstream maintainer Tatu Saloranta in commit f6d9c664f6d on 2020-06-13. This fix was already included in the upstream jackson-databind 2.16.0 release that TuxCare onboarded. The target version contains the protective blocklist entry at line 207 of SubTypeValidator.java, preventing deserialization of the malicious class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the org.jsecurity.realm.jndi.JndiRealmFactory gadget class to achieve code execution. The fix, which adds this class to the SubTypeValidator blocklist, was implemented by upstream maintainer Tatu Saloranta in commit f6d9c664f6d on 2020-06-13. This fix was already included in the upstream jackson-databind 2.16.0 release that TuxCare onboarded. The target version contains the protective blocklist entry at line 207 of SubTypeValidator.java, preventing deserialization of the malicious class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:21:46.608783+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 affects jackson-databind versions before 2.9.10.6, allowing deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPDataSource which can lead to arbitrary code execution. The target version 2.16.0-tuxcare.4 contains the upstream fix (commit 3d97153944f7 by Tatu Saloranta) that adds this class to the SubTypeValidator blocklist at line 147, preventing its deserialization. The fix was part of upstream release 2.16.0 that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 affects jackson-databind versions before 2.9.10.6, allowing deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPDataSource which can lead to arbitrary code execution. The target version 2.16.0-tuxcare.4 contains the upstream fix (commit 3d97153944f7 by Tatu Saloranta) that adds this class to the SubTypeValidator blocklist at line 147, preventing its deserialization. The fix was part of upstream release 2.16.0 that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:17:20.138118+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the dangerous class com.pastdev.httpcomponents.configuration.JndiConfiguration which can lead to RCE via JNDI injection. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 210), was already present in the upstream 2.16.0 release that TuxCare onboarded. The fix commit 6cc9f1a1af by tatu.saloranta@iki.fi (upstream author) is an ancestor of the TuxCare onboarding commit 0a101b8833.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the dangerous class com.pastdev.httpcomponents.configuration.JndiConfiguration which can lead to RCE via JNDI injection. The fix, which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 210), was already present in the upstream 2.16.0 release that TuxCare onboarded. The fix commit 6cc9f1a1af by tatu.saloranta@iki.fi (upstream author) is an ancestor of the TuxCare onboarding commit 0a101b8833.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.16.0. The upstream fix (commit 612f971b78, authored by Tatu Saloranta on 2020-01-09) was included in jackson-databind 2.11.0 and shipped with the upstream 2.16.0 release that TuxCare onboarded. The fix configures the XML parser to disable DOCTYPE declarations and external DTD loading, preventing XXE attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is NOT present in jackson-databind 2.16.0. The upstream fix (commit 612f971b78, authored by Tatu Saloranta on 2020-01-09) was included in jackson-databind 2.11.0 and shipped with the upstream 2.16.0 release that TuxCare onboarded. The fix configures the XML parser to disable DOCTYPE declarations and external DTD loading, preventing XXE attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:22:45.297248+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization gadgets in Apache Commons DBCP2 datasource classes (PerUserPoolDataSource and SharedPoolDataSource) that allow arbitrary code execution via polymorphic type handling. The target already contains the upstream fix from commit 41b8bdb5cc, which blocks deserialization of these dangerous classes by adding them to the SubTypeValidator deny list. This fix was shipped in upstream release 2.16.0 before TuxCare onboarded the version, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization gadgets in Apache Commons DBCP2 datasource classes (PerUserPoolDataSource and SharedPoolDataSource) that allow arbitrary code execution via polymorphic type handling. The target already contains the upstream fix from commit 41b8bdb5cc, which blocks deserialization of these dangerous classes by adding them to the SubTypeValidator deny list. This fix was shipped in upstream release 2.16.0 before TuxCare onboarded the version, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:48:08.430268+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.16.0-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) adds both classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization during polymorphic type handling. This fix was already present in upstream release 2.16.0 when TuxCare onboarded it (first TuxCare commit: 0a101b88). The blocklist entries are at lines 217-218, and the enforcement logic at line 269 actively rejects deserialization when the class name matches. Verdict: not_affected with justification code_not_present (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.16.0-tuxcare.3. The vulnerability involves deserialization gadgets in org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) adds both classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their deserialization during polymorphic type handling. This fix was already present in upstream release 2.16.0 when TuxCare onboarded it (first TuxCare commit: 0a101b88). The blocklist entries are at lines 217-218, and the enforcement logic at line 269 actively rejects deserialization when the class name matches. Verdict: not_affected with justification code_not_present (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:55:19.903675+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class leading to remote code execution. The fix (adding this class to the deserialization blocklist) was included in upstream release 2.12.1 (commit 1ca0388c2f, Dec 2020) and is present in the target version 2.16.0, which inherited this fix from the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool gadget class leading to remote code execution. The fix (adding this class to the deserialization blocklist) was included in upstream release 2.12.1 (commit 1ca0388c2f, Dec 2020) and is present in the target version 2.16.0, which inherited this fix from the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerns missing deserialization blacklist entries for DriverAdapterCPDS classes from various DBCP library namespaces. The upstream fix (commit 3ded28aece) was included in upstream release 2.16.0 before TuxCare onboarded it. All five DriverAdapterCPDS variants (org.apache.commons.dbcp, oadd.org.apache.commons.dbcp, org.apache.commons.dbcp2, org.apache.tomcat.dbcp.dbcp, org.apache.tomcat.dbcp.dbcp2) are present in the SubTypeValidator blacklist, preventing Jackson from deserializing these dangerous gadget classes during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerns missing deserialization blacklist entries for DriverAdapterCPDS classes from various DBCP library namespaces. The upstream fix (commit 3ded28aece) was included in upstream release 2.16.0 before TuxCare onboarded it. All five DriverAdapterCPDS variants (org.apache.commons.dbcp, oadd.org.apache.commons.dbcp, org.apache.commons.dbcp2, org.apache.tomcat.dbcp.dbcp, org.apache.tomcat.dbcp.dbcp2) are present in the SubTypeValidator blacklist, preventing Jackson from deserializing these dangerous gadget classes during polymorphic type resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:39:06.088867+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for DriverAdapterCPDS gadget classes. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.16.0 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are properly blocked in SubTypeValidator.java at lines 123, 193, 219, 228, and 234. The fix commit (3ded28aece) was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release, predating the first TuxCare commit (0a101b883).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for DriverAdapterCPDS gadget classes. The target repository (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the fix was already present in the upstream 2.16.0 release that TuxCare onboarded. All five DriverAdapterCPDS class variants are properly blocked in SubTypeValidator.java at lines 123, 193, 219, 228, and 234. The fix commit (3ded28aece) was authored by upstream maintainer Tatu Saloranta and shipped with the upstream release, predating the first TuxCare commit (0a101b883).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:30.480251+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8. The target is version 2.16.0, which already contains the upstream fix. The vulnerable gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` is blacklisted in SubTypeValidator.java (line 228) as part of commit 3ded28aece by upstream maintainer Tatu Saloranta. This fix was already present in the upstream 2.16.0 release before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8. The target is version 2.16.0, which already contains the upstream fix. The vulnerable gadget class `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS` is blacklisted in SubTypeValidator.java (line 228) as part of commit 3ded28aece by upstream maintainer Tatu Saloranta. This fix was already present in the upstream 2.16.0 release before TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:13:29.562378+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions that lack blocklist protection for the deserialization gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target version 2.16.0-tuxcare.4 is NOT affected because the upstream fix (commit 3ded28aece, authored by Tatu Saloranta on 2020-12-31) was already included in the upstream release 2.16.0 that TuxCare onboarded. The dangerous class is present in SubTypeValidator.java's blocklist at line 234, preventing polymorphic deserialization exploitation. This is an upstream vendor fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 affects jackson-databind versions that lack blocklist protection for the deserialization gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target version 2.16.0-tuxcare.4 is NOT affected because the upstream fix (commit 3ded28aece, authored by Tatu Saloranta on 2020-12-31) was already included in the upstream release 2.16.0 that TuxCare onboarded. The dangerous class is present in SubTypeValidator.java's blocklist at line 234, preventing polymorphic deserialization exploitation. This is an upstream vendor fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:21:42.964789+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerned a missing blocklist entry for the deserialization gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 12e23c962ff by Tatu Saloranta, dated 2020-12-31) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.16.0 release when TuxCare onboarded it (commit 0a101b88). The blocklist entry at line 243 of SubTypeValidator.java prevents instantiation of this dangerous class during polymorphic deserialization, blocking the JNDI injection attack vector. Verdict: not_affected because the upstream vendor shipped the fix before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability concerned a missing blocklist entry for the deserialization gadget class org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The upstream fix (commit 12e23c962ff by Tatu Saloranta, dated 2020-12-31) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.16.0 release when TuxCare onboarded it (commit 0a101b88). The blocklist entry at line 243 of SubTypeValidator.java prevents instantiation of this dangerous class during polymorphic deserialization, blocking the JNDI injection attack vector. Verdict: not_affected because the upstream vendor shipped the fix before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.0-tuxcare.3 is not affected by CVE-2020-36184. The vulnerability involves polymorphic deserialization gadgets (org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.16.0, which TuxCare onboarded. The blocklist is actively enforced during deserialization (line 269 checks the blocklist; lines 302-303 reject blocked classes with \"Illegal type to deserialize: prevented for security reasons\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "Target jackson-databind 2.16.0-tuxcare.3 is not affected by CVE-2020-36184. The vulnerability involves polymorphic deserialization gadgets (org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in upstream version 2.16.0, which TuxCare onboarded. The blocklist is actively enforced during deserialization (line 269 checks the blocklist; lines 302-303 reject blocked classes with \"Illegal type to deserialize: prevented for security reasons\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:08:45.993587+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind 2.16.0. The vulnerability affects jackson-databind 2.x before 2.9.10.8 and involves missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource deserialization gadgets. The target version 2.16.0 already contains the upstream fix (commit 567194c5) that adds these classes to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at lines 235-236. This fix was shipped in the upstream release before TuxCare onboarded version 2.16.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is not present in jackson-databind 2.16.0. The vulnerability affects jackson-databind 2.x before 2.9.10.8 and involves missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource deserialization gadgets. The target version 2.16.0 already contains the upstream fix (commit 567194c5) that adds these classes to DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java at lines 235-236. This fix was shipped in the upstream release before TuxCare onboarded version 2.16.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:35:42.158102+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves polymorphic deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea by Tatu Saloranta) added this class to the SubTypeValidator deny-list, blocking its deserialization. This fix was already included in the upstream 2.16.0 release that TuxCare onboarded, so the vulnerable pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves polymorphic deserialization of the gadget class org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. The upstream fix (commit 3e8fa3beea by Tatu Saloranta) added this class to the SubTypeValidator deny-list, blocking its deserialization. This fix was already included in the upstream 2.16.0 release that TuxCare onboarded, so the vulnerable pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:48:05.007690+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.16.0-tuxcare.4 is not affected by CVE-2020-36187. The fix adding org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource to the deserialization blacklist was already present in the upstream 2.16.0 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize the SharedPoolDataSource gadget class) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "The target jackson-databind 2.16.0-tuxcare.4 is not affected by CVE-2020-36187. The fix adding org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource to the deserialization blacklist was already present in the upstream 2.16.0 release that TuxCare onboarded. The vulnerable code pattern (ability to deserialize the SharedPoolDataSource gadget class) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:53:25.637541+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, concerning unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource gadget class. The target (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 33d96c13 by Tatu Saloranta, Dec 2020) was already present in version 2.16.0 when TuxCare onboarded it. Both gadget classes are in the SubTypeValidator blocklist (lines 223-224), which is enforced during polymorphic deserialization. The vulnerable pattern (unrestricted deserialization of these classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 affects jackson-databind versions before 2.9.10.8 and 2.6.7.5, concerning unsafe deserialization of com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource gadget class. The target (jackson-databind 2.16.0-tuxcare.4) is NOT AFFECTED because the upstream fix (commit 33d96c13 by Tatu Saloranta, Dec 2020) was already present in version 2.16.0 when TuxCare onboarded it. Both gadget classes are in the SubTypeValidator blocklist (lines 223-224), which is enforced during polymorphic deserialization. The vulnerable pattern (unrestricted deserialization of these classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:05:07.573388+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, related to the deserialization gadget com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The target repository version 2.16.0 is not affected because the fix was already present in the upstream 2.16.0 release. The vulnerable class names were added to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 223-224) by upstream commit 33d96c13fe, which is an ancestor of the TuxCare onboarding commit. The fix was authored by the upstream maintainer tatu.saloranta@iki.fi and shipped with the original 2.16.0 release, not added by TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 affects jackson-databind versions before 2.9.10.8, related to the deserialization gadget com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. The target repository version 2.16.0 is not affected because the fix was already present in the upstream 2.16.0 release. The vulnerable class names were added to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java (lines 223-224) by upstream commit 33d96c13fe, which is an ancestor of the TuxCare onboarding commit. The fix was authored by the upstream maintainer tatu.saloranta@iki.fi and shipped with the original 2.16.0 release, not added by TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:16:43.496825+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability was fixed in upstream commit 8238ab41d0 which replaced the vulnerable recursive UntypedObjectDeserializer.Vanilla class with the non-recursive UntypedObjectDeserializerNR implementation. This fix was already present in jackson-databind 2.16.0 when TuxCare onboarded it. The vulnerable recursive code pattern no longer exists in the production code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.16.0-tuxcare.4. The vulnerability was fixed in upstream commit 8238ab41d0 which replaced the vulnerable recursive UntypedObjectDeserializer.Vanilla class with the non-recursive UntypedObjectDeserializerNR implementation. This fix was already present in jackson-databind 2.16.0 when TuxCare onboarded it. The vulnerable recursive code pattern no longer exists in the production code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:13:53.139556+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2020-8840. The fix for this vulnerability (blocking org.apache.xbean.propertyeditor.JndiConverter from deserialization) was shipped in the upstream 2.16.0 release and is present in the target code. The dangerous class is blocklisted in SubTypeValidator.java at line 138 and enforcement occurs at line 269. The fix commit (914e7c9f2c by tatu.saloranta@iki.fi) is an ancestor of the TuxCare onboarding commit, confirming it came with the upstream release rather than as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "Target jackson-databind 2.16.0-tuxcare.4 is NOT AFFECTED by CVE-2020-8840. The fix for this vulnerability (blocking org.apache.xbean.propertyeditor.JndiConverter from deserialization) was shipped in the upstream 2.16.0 release and is present in the target code. The dangerous class is blocklisted in SubTypeValidator.java at line 138 and enforcement occurs at line 269. The fix commit (914e7c9f2c by tatu.saloranta@iki.fi) is an ancestor of the TuxCare onboarding commit, confirming it came with the upstream release rather than as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is not present in jackson-databind 2.16.0. The vulnerability involves deserialization of the malicious gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (FasterXML) fixed this in commit 1e64db6a2f by adding the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.16.0 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is not present in jackson-databind 2.16.0. The vulnerability involves deserialization of the malicious gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig. The upstream vendor (FasterXML) fixed this in commit 1e64db6a2f by adding the gadget class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.16.0 release that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:45:35.958455+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` which could lead to remote code execution. The upstream vendor (Tatu Saloranta) fixed this in commit 1e64db6a2f by adding the class to SubTypeValidator's blocklist. This fix was already present in the upstream jackson-databind 2.16.0 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of the gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` which could lead to remote code execution. The upstream vendor (Tatu Saloranta) fixed this in commit 1e64db6a2f by adding the class to SubTypeValidator's blocklist. This fix was already present in the upstream jackson-databind 2.16.0 release that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:18:43.675482+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is NOT affecting this target. The vulnerability involves deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPConfig through Jackson's polymorphic type handling. The upstream vendor (FasterXML) fixed this by adding the class to the blocklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.16.0 when TuxCare onboarded it, so the vulnerable code pattern has never been present in any TuxCare-maintained version of this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is NOT affecting this target. The vulnerability involves deserialization of the dangerous gadget class br.com.anteros.dbcp.AnterosDBCPConfig through Jackson's polymorphic type handling. The upstream vendor (FasterXML) fixed this by adding the class to the blocklist in SubTypeValidator.java. This fix was already present in jackson-databind 2.16.0 when TuxCare onboarded it, so the vulnerable code pattern has never been present in any TuxCare-maintained version of this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:16:30.596459+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of dangerous \"gadget\" classes (particularly javax.swing.JTextPane and many others) that can lead to RCE, JNDI injection, or SSRF. The fix adds these dangerous class names to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This fix was already present in upstream release 2.16.0 when TuxCare onboarded it (commit 0a101b8833), authored by community contributor qxo (49526356@qq.com) in commit 08fbfacf89. The target contains the complete blocklist with all CVE-2021-20190 gadgets, and the validator is actively invoked during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.16.0-tuxcare.4. The vulnerability involves deserialization of dangerous \"gadget\" classes (particularly javax.swing.JTextPane and many others) that can lead to RCE, JNDI injection, or SSRF. The fix adds these dangerous class names to a blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This fix was already present in upstream release 2.16.0 when TuxCare onboarded it (commit 0a101b8833), authored by community contributor qxo (49526356@qq.com) in commit 08fbfacf89. The target contains the complete blocklist with all CVE-2021-20190 gadgets, and the validator is actively invoked during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877: Target jackson-databind 2.16.0-tuxcare.4 is not affected. The vulnerability involved excessive heap allocation (up to 2GB) during JDK deserialization of JsonNode when a maliciously crafted serialized object claimed a huge byte array length. The upstream fix (commit 3ccde7d938, Dec 2021) limits eager allocation to 100KB and uses incremental ByteArrayBuilder for larger sizes. This fix was already present in upstream jackson-databind 2.16.0 before TuxCare onboarding (Sep 2026), making it an upstream-shipped fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877: Target jackson-databind 2.16.0-tuxcare.4 is not affected. The vulnerability involved excessive heap allocation (up to 2GB) during JDK deserialization of JsonNode when a maliciously crafted serialized object claimed a huge byte array length. The upstream fix (commit 3ccde7d938, Dec 2021) limits eager allocation to 100KB and uses incremental ByteArrayBuilder for larger sizes. This fix was already present in upstream jackson-databind 2.16.0 before TuxCare onboarding (Sep 2026), making it an upstream-shipped fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:47:24.883937+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.16.0-tuxcare.4 is not affected by CVE-2022-42003. The upstream fix for this vulnerability (preventing resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was included in upstream version 2.14.0 and is present in the 2.16.0 release that TuxCare onboarded. The fix adds checks in primitive value deserializers and BeanDeserializer to detect and reject nested arrays, limiting wrapper array nesting to a single level. Fix commit d78d00ee7b5245b93103fef3187f70543d67ca33 by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "The target jackson-databind version 2.16.0-tuxcare.4 is not affected by CVE-2022-42003. The upstream fix for this vulnerability (preventing resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was included in upstream version 2.14.0 and is present in the 2.16.0 release that TuxCare onboarded. The fix adds checks in primitive value deserializers and BeanDeserializer to detect and reject nested arrays, limiting wrapper array nesting to a single level. Fix commit d78d00ee7b5245b93103fef3187f70543d67ca33 by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:58:37.746578+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42004 affects jackson-databind versions before 2.12.7.1 and 2.13.x before 2.13.4, causing resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.16.0 is NOT affected because the fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88) was authored by upstream maintainer Tatu Saloranta on 2022-08-23 and shipped in the upstream 2.16.0 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() (lines 639-647) that rejects nested arrays when unwrapping, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "CVE-2022-42004 affects jackson-databind versions before 2.12.7.1 and 2.13.x before 2.13.4, causing resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The target version 2.16.0 is NOT affected because the fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88) was authored by upstream maintainer Tatu Saloranta on 2022-08-23 and shipped in the upstream 2.16.0 release that TuxCare onboarded. The fix adds a check in BeanDeserializer._deserializeFromArray() (lines 639-647) that rejects nested arrays when unwrapping, preventing unbounded recursion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T20:20:47.881481+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 affects jackson-databind versions before 2.14.0 via recursive serialization in JsonNode.toString() causing DoS with deeply nested JSON. The target (2.16.0-tuxcare.4) contains the upstream fix introduced in 2.14.0: non-recursive serialization via InternalNodeMapper.WrapperForSerializer. The fix (commit a1fa4ae4ec \"Fix #3447\" by upstream author tatu.saloranta@iki.fi) was present in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 affects jackson-databind versions before 2.14.0 via recursive serialization in JsonNode.toString() causing DoS with deeply nested JSON. The target (2.16.0-tuxcare.4) contains the upstream fix introduced in 2.14.0: non-recursive serialization via InternalNodeMapper.WrapperForSerializer. The fix (commit a1fa4ae4ec \"Fix #3447\" by upstream author tatu.saloranta@iki.fi) was present in..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T10:56:10.105856+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.16.0-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T02:41:00.167232+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.16.0 is NOT affected by CVE-2026-54517. While the code has the same missing view check in the property-buffering path that exists in vulnerable versions, the attack chain is broken because the mechanism to properly buffer and apply setterless properties (bufferMergingProperty + PropertyValue.Merging + isMerging check) was not introduced until version 2.21.0. In 2.16.0, if a setterless...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 Version 2.16.0 is NOT affected by CVE-2026-54517. While the code has the same missing view check in the property-buffering path that exists in vulnerable versions, the attack chain is broken because the mechanism to properly buffer and apply setterless properties (bufferMergingProperty + PropertyValue.Merging + isMerging check) was not introduced until version 2.21.0. In 2.16.0, if a setterless..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T02:10:36.661642+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.16.0-tuxcare.4 is not affected by CVE-2026-54518. The vulnerable code pattern (processUnwrappedCreatorProperties method without view check) does not exist in this version. The feature enabling @JsonUnwrapped on creator parameters was introduced in version 2.19 (commit 502fe888da, Nov 2024). Version 2.16.0 explicitly rejects this combination with InvalidDefinitionException: \"Cannot def...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.16.0-tuxcare.4 is not affected by CVE-2026-54518. The vulnerable code pattern (processUnwrappedCreatorProperties method without view check) does not exist in this version. The feature enabling @JsonUnwrapped on creator parameters was introduced in version 2.19 (commit 502fe888da, Nov 2024). Version 2.16.0 explicitly rejects this combination with InvalidDefinitionException: \"Cannot def..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:05:00.098712+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:05:00.098712+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.16.0-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T12:04:18.896920+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.16.0-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}