{
  "@id": "urn:uuid:3f020068-c277-43c7-99db-d67387c2bb14",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T10:39:30.987552+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability affects versions prior to 2.8.11 and 2.9.4. The target contains comprehensive blacklist defenses in SubTypeValidator that prevent deserialization of all gadget classes mentioned in the CVE (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and others from issues #1680 and #1737). These fixes were authored by upstream FasterXML maintainer Tatu Saloranta and shipped in the original 2.17.0 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability affects versions prior to 2.8.11 and 2.9.4. The target contains comprehensive blacklist defenses in SubTypeValidator that prevent deserialization of all gadget classes mentioned in the CVE (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and others from issues #1680 and #1737). These fixes were authored by upstream FasterXML maintainer Tatu Saloranta and shipped in the original 2.17.0 release, predating TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability (incomplete blacklist for polymorphic deserialization allowing RCE via Spring framework gadgets) was fixed in upstream jackson-databind 2.8.11/2.9.4 and has been present in all 2.17.x releases. The target contains the SubTypeValidator class with comprehensive blacklists for all CVE-2017-17485 gadgets (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader) plus parent class hierarchy checking for Spring types (AbstractPointcutAdvisor, AbstractApplicationContext). The fix was introduced by upstream commit 2235894210c75f624a3d0cd60bfb0434a20a18bf and shipped in the upstream 2.17.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability (incomplete blacklist for polymorphic deserialization allowing RCE via Spring framework gadgets) was fixed in upstream jackson-databind 2.8.11/2.9.4 and has been present in all 2.17.x releases. The target contains the SubTypeValidator class with comprehensive blacklists for all CVE-2017-17485 gadgets (java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, org.apache.tomcat.dbcp.dbcp2.BasicDataSource, com.sun.org.apache.bcel.internal.util.ClassLoader) plus parent class hierarchy checking for Spring types (AbstractPointcutAdvisor, AbstractApplicationContext). The fix was introduced by upstream commit 2235894210c75f624a3d0cd60bfb0434a20a18bf and shipped in the upstream 2.17.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.0 is not affected by CVE-2017-7525. The vulnerability, which allowed arbitrary code execution via deserialization of malicious JSON with polymorphic type information pointing to dangerous gadget classes (TemplatesImpl), is mitigated by SubTypeValidator. This defense mechanism maintains a comprehensive blocklist of dangerous classes and validates all bean types during deserializer creation. The fix was shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target jackson-databind 2.17.0 is not affected by CVE-2017-7525. The vulnerability, which allowed arbitrary code execution via deserialization of malicious JSON with polymorphic type information pointing to dangerous gadget classes (TemplatesImpl), is mitigated by SubTypeValidator. This defense mechanism maintains a comprehensive blocklist of dangerous classes and validates all bean types during deserializer creation. The fix was shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 via deserialization of org.apache.ibatis.parsing.XPathParser gadget class. The target (version 2.17.0-tuxcare.2) contains the upstream fix (commit 27b4defc by Tatu Saloranta) which adds XPathParser to the SubTypeValidator blacklist. This fix was already present in upstream 2.17.0 when TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 via deserialization of org.apache.ibatis.parsing.XPathParser gadget class. The target (version 2.17.0-tuxcare.2) contains the upstream fix (commit 27b4defc by Tatu Saloranta) which adds XPathParser to the SubTypeValidator blacklist. This fix was already present in upstream 2.17.0 when TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.17.0. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 (2018). The upstream vendor (FasterXML) fixed this in 2018 by adding \"jodd.db.connection.DataSourceConnectionProvider\" to the deserialization blacklist in SubTypeValidator.java. This fix was included in the upstream release 2.17.0 (2024) that TuxCare onboarded. The blacklist entry is present at line 68 of SubTypeValidator.java, and the validation method (lines 269-270, 302-303) enforces the blacklist by rejecting any attempt to deserialize the dangerous Jodd-db class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.17.0. The vulnerability affects versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6 (2018). The upstream vendor (FasterXML) fixed this in 2018 by adding \"jodd.db.connection.DataSourceConnectionProvider\" to the deserialization blacklist in SubTypeValidator.java. This fix was included in the upstream release 2.17.0 (2024) that TuxCare onboarded. The blacklist entry is present at line 68 of SubTypeValidator.java, and the validation method (lines 269-270, 302-303) enforces the blacklist by rejecting any attempt to deserialize the dangerous Jodd-db class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 does not affect jackson-databind 2.17.0-tuxcare.2. The vulnerability concerns unsafe polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP injection attacks when Default Typing is enabled. The upstream fix, which adds these classes to the SubTypeValidator blacklist, was already present in the upstream 2.17.0 release that TuxCare onboarded. The target version includes the complete defense mechanism at SubTypeValidator.java lines 70-72, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 does not affect jackson-databind 2.17.0-tuxcare.2. The vulnerability concerns unsafe polymorphic deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that enable JNDI/LDAP injection attacks when Default Typing is enabled. The upstream fix, which adds these classes to the SubTypeValidator blacklist, was already present in the upstream 2.17.0 release that TuxCare onboarded. The target version includes the complete defense mechanism at SubTypeValidator.java lines 70-72, preventing deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 addresses a polymorphic deserialization vulnerability in jackson-databind that allows remote code execution via the slf4j-ext class (org.slf4j.ext.EventData). The target repository jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in version 2.17.0 when TuxCare onboarded it. The fix adds org.slf4j.ext.EventData and other dangerous classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing their use in polymorphic deserialization. The fix was authored by upstream developer Tatu Saloranta (commit 87d29af25e) and shipped in the upstream 2.17.0 release before TuxCare's onboarding commit ff3fad27c6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 addresses a polymorphic deserialization vulnerability in jackson-databind that allows remote code execution via the slf4j-ext class (org.slf4j.ext.EventData). The target repository jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in version 2.17.0 when TuxCare onboarded it. The fix adds org.slf4j.ext.EventData and other dangerous classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java, preventing their use in polymorphic deserialization. The fix was authored by upstream developer Tatu Saloranta (commit 87d29af25e) and shipped in the upstream 2.17.0 release before TuxCare's onboarding commit ff3fad27c6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to polymorphic deserialization of dangerous BlazeDS and other gadget classes. The target repository (jackson-databind 2.17.0-tuxcare.2) contains the upstream fix (commit 87d29af25e) that was shipped in the original 2.17.0 release. The fix adds four dangerous classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (BlazeDS), com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This blocklist is enforced by SubTypeValidator.validateSubType() during deserialization, preventing instantiation of these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta in August 2018 and was already present when TuxCare onboarded version 2.17.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7/2.8.11.3/2.7.9.5 due to polymorphic deserialization of dangerous BlazeDS and other gadget classes. The target repository (jackson-databind 2.17.0-tuxcare.2) contains the upstream fix (commit 87d29af25e) that was shipped in the original 2.17.0 release. The fix adds four dangerous classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor (BlazeDS), com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This blocklist is enforced by SubTypeValidator.validateSubType() during deserialization, preventing instantiation of these gadget classes. The fix was authored by upstream maintainer Tatu Saloranta in August 2018 and was already present when TuxCare onboarded version 2.17.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is not present in jackson-databind 2.17.0. The vulnerability involves polymorphic deserialization of dangerous JDK and third-party classes that can enable XXE and other attacks. The fix (commit 87d29af25e) adds four classes to the deserialization blacklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was authored by upstream maintainer Tatu Saloranta and was already included in upstream version 2.17.0 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is not present in jackson-databind 2.17.0. The vulnerability involves polymorphic deserialization of dangerous JDK and third-party classes that can enable XXE and other attacks. The fix (commit 87d29af25e) adds four classes to the deserialization blacklist: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl. This fix was authored by upstream maintainer Tatu Saloranta and was already included in upstream version 2.17.0 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 concerns polymorphic deserialization of the axis2-jaxws class enabling SSRF attacks in jackson-databind versions before 2.9.7. The target version 2.17.0-tuxcare.2 is not affected because the upstream fix (commit 0899726ec34) was already present in the upstream release that TuxCare onboarded. The fix adds \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing polymorphic deserialization of this dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 concerns polymorphic deserialization of the axis2-jaxws class enabling SSRF attacks in jackson-databind versions before 2.9.7. The target version 2.17.0-tuxcare.2 is not affected because the upstream fix (commit 0899726ec34) was already present in the upstream release that TuxCare onboarded. The fix adds \"org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl\" to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing polymorphic deserialization of this dangerous gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo class in polymorphic deserialization. The target version 2.17.0 is NOT affected because the upstream fix (commit 72cd4025a2) was already present in the 2.17.0 release that TuxCare onboarded. The fix adds org.apache.axis2.transport.jms.JMSOutTransportInfo to SubTypeValidator's blocklist (line 85), preventing deserialization of this gadget class. The fix is authored by upstream maintainer Tatu Saloranta, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo class in polymorphic deserialization. The target version 2.17.0 is NOT affected because the upstream fix (commit 72cd4025a2) was already present in the 2.17.0 release that TuxCare onboarded. The fix adds org.apache.axis2.transport.jms.JMSOutTransportInfo to SubTypeValidator's blocklist (line 85), preventing deserialization of this gadget class. The fix is authored by upstream maintainer Tatu Saloranta, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.0 is not affected by CVE-2018-19361. The vulnerability pattern (missing blocklist entries for openjpa classes during polymorphic deserialization) is not present. The fix that blocks org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime was already included in the upstream jackson-databind 2.17.0 release by author Tatu Saloranta (commit 72cd4025a), which predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "The target jackson-databind 2.17.0 is not affected by CVE-2018-19361. The vulnerability pattern (missing blocklist entries for openjpa classes during polymorphic deserialization) is not present. The fix that blocks org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime was already included in the upstream jackson-databind 2.17.0 release by author Tatu Saloranta (commit 72cd4025a), which predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability allowed polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core, enabling arbitrary code execution. The fix (upstream commit 72cd4025a2 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was included in upstream release 2.9.8 (November 2018) and inherited by version 2.17.0 (March 2024) when TuxCare onboarded it. The dangerous class is blocked at line 81, and validateSubType() enforces the blocklist during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability allowed polymorphic deserialization of org.jboss.util.propertyeditor.DocumentEditor from jboss-common-core, enabling arbitrary code execution. The fix (upstream commit 72cd4025a2 by Tatu Saloranta) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was included in upstream release 2.9.8 (November 2018) and inherited by version 2.17.0 (March 2024) when TuxCare onboarded it. The dangerous class is blocked at line 81, and validateSubType() enforces the blocklist during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.17.0. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the existing blacklist to achieve remote code execution. The upstream fix added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.17.0 release when TuxCare onboarded it in September 2026. The fix commit (038b471e2e, dated 2018-01-21) is an ancestor of the TuxCare onboarding commit (ff3fad27c60e). Both gadget classes are confirmed present in the blacklist at SubTypeValidator.java lines 62-63, and the validation mechanism is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.17.0. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass the existing blacklist to achieve remote code execution. The upstream fix added these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.17.0 release when TuxCare onboarded it in September 2026. The fix commit (038b471e2e, dated 2018-01-21) is an ancestor of the TuxCare onboarding commit (ff3fad27c60e). Both gadget classes are confirmed present in the blacklist at SubTypeValidator.java lines 62-63, and the validation mechanism is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is NOT present in jackson-databind 2.17.0-tuxcare.2. The fix blocking deserialization of c3p0 DataSource classes was already included in the upstream 2.17.0 release that TuxCare onboarded. The protection was added by upstream maintainer Tatu Saloranta in commit 6799f8f10c (2018-02-10), more than 6 years before 2.17.0 was released. The fix adds validation in SubTypeValidator that rejects any class name starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\", preventing the remote code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is NOT present in jackson-databind 2.17.0-tuxcare.2. The fix blocking deserialization of c3p0 DataSource classes was already included in the upstream 2.17.0 release that TuxCare onboarded. The protection was added by upstream maintainer Tatu Saloranta in commit 6799f8f10c (2018-02-10), more than 6 years before 2.17.0 was released. The fix adds validation in SubTypeValidator that rejects any class name starting with \"com.mchange.v2.c3p0.\" and ending with \"DataSource\", preventing the remote code execution attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2019-12086. The vulnerability was fixed in upstream version 2.9.9 (May 2019) by adding \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the blocklist in SubTypeValidator. Since the target version 2.17.0 is significantly newer (released February 2024), this fix was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:88 and is actively enforced during bean deserialization with no possibility of bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2019-12086. The vulnerability was fixed in upstream version 2.9.9 (May 2019) by adding \"com.mysql.cj.jdbc.admin.MiniAdmin\" to the blocklist in SubTypeValidator. Since the target version 2.17.0 is significantly newer (released February 2024), this fix was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:88 and is actively enforced during bean deserialization with no possibility of bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2019-12384. The vulnerability requires the ability to deserialize the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource via polymorphic typing to achieve arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream 2.17.0 release that TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2019-12384. The vulnerability requires the ability to deserialize the logback-core class ch.qos.logback.core.db.DriverManagerConnectionSource via polymorphic typing to achieve arbitrary code execution. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream 2.17.0 release that TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 describes a polymorphic typing vulnerability in jackson-databind allowing arbitrary file reads via JDOM XSLTransformer classes when Default Typing is enabled. The target repository (jackson-databind 2.17.0-tuxcare.2) contains the upstream fix that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java. This fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 describes a polymorphic typing vulnerability in jackson-databind allowing arbitrary file reads via JDOM XSLTransformer classes when Default Typing is enabled. The target repository (jackson-databind 2.17.0-tuxcare.2) contains the upstream fix that blocks deserialization of org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer in SubTypeValidator.java. This fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.17.0-tuxcare.1. The vulnerability involves deserialization of dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that enable remote code execution via polymorphic type handling. The upstream vendor (Tatu Saloranta) already fixed this in commit ad418eeb (2019-07-25) by adding these classes to the SubTypeValidator blocklist. This fix was part of the upstream jackson-databind release that TuxCare onboarded as version 2.17.0, appearing 4483 commits before the first TuxCare commit (ff3fad27). The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.17.0-tuxcare.1. The vulnerability involves deserialization of dangerous classes (net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource) that enable remote code execution via polymorphic type handling. The upstream vendor (Tatu Saloranta) already fixed this in commit ad418eeb (2019-07-25) by adding these classes to the SubTypeValidator blocklist. This fix was part of the upstream jackson-databind release that TuxCare onboarded as version 2.17.0, appearing 4483 commits before the first TuxCare commit (ff3fad27). The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is NOT present in jackson-databind 2.17.0-tuxcare.2. The upstream fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by Tatu Saloranta, dated 2019-07-25) that adds ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist was already included in the upstream release that TuxCare onboarded. The vulnerable pattern is not present because SubTypeValidator.java contains the blacklist entries (lines 98, 102) and enforces them via validateSubType() during polymorphic deserialization, preventing instantiation of dangerous classes that could trigger JNDI attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is NOT present in jackson-databind 2.17.0-tuxcare.2. The upstream fix (commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b by Tatu Saloranta, dated 2019-07-25) that adds ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup to the deserialization blacklist was already included in the upstream release that TuxCare onboarded. The vulnerable pattern is not present because SubTypeValidator.java contains the blacklist entries (lines 98, 102) and enforces them via validateSubType() during polymorphic deserialization, preventing instantiation of dangerous classes that could trigger JNDI attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 is not present in jackson-databind 2.17.0. The vulnerability related to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource was fixed in upstream commits d4983c740f and 73c1c2cc76 by Tatu Saloranta. These fixes were already present in the upstream 2.17.0 release that TuxCare onboarded (first TuxCare commit ff3fad27c6). The SubTypeValidator blocklist contains both HikariConfig (line 105) and HikariDataSource (line 107), preventing their deserialization with the error message \"Illegal type (%s) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 is not present in jackson-databind 2.17.0. The vulnerability related to polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource was fixed in upstream commits d4983c740f and 73c1c2cc76 by Tatu Saloranta. These fixes were already present in the upstream 2.17.0 release that TuxCare onboarded (first TuxCare commit ff3fad27c6). The SubTypeValidator blocklist contains both HikariConfig (line 105) and HikariDataSource (line 107), preventing their deserialization with the error message \"Illegal type (%s) to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability concerned polymorphic deserialization of commons-configuration JNDI classes that could lead to arbitrary code execution. The upstream fix (commit 41b7f9b901 by Tatu Saloranta, 2019-09-19) added blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to SubTypeValidator.java. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded (first TuxCare commit ff3fad27c6), meaning the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability concerned polymorphic deserialization of commons-configuration JNDI classes that could lead to arbitrary code execution. The upstream fix (commit 41b7f9b901 by Tatu Saloranta, 2019-09-19) added blocklist entries for org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to SubTypeValidator.java. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded (first TuxCare commit ff3fad27c6), meaning the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to remote code execution. The fix was committed by upstream author Tatu Saloranta on 2019-09-19 (commit 998efd7082) and was already included in the upstream release 2.17.0 that TuxCare onboarded. The SubTypeValidator.java file contains the xalan gadget in its deserialization blocklist at line 117, preventing instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves polymorphic deserialization of the xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) that could lead to remote code execution. The fix was committed by upstream author Tatu Saloranta on 2019-09-19 (commit 998efd7082) and was already included in the upstream release 2.17.0 that TuxCare onboarded. The SubTypeValidator.java file contains the xalan gadget in its deserialization blocklist at line 117, preventing instantiation of this dangerous class during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to RCE through gadget chain exploitation. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in upstream version 2.17.0 before TuxCare onboarding. The fix commit 73c1c2cc76e by upstream maintainer Tatu Saloranta shipped in the upstream release, and the target version is far newer than the affected versions (before 2.9.10, 2.8.11.5, 2.6.7.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "The target repository jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2019-16335. The vulnerability involves polymorphic deserialization of com.zaxxer.hikari.HikariDataSource, which could lead to RCE through gadget chain exploitation. The fix (adding HikariDataSource to the SubTypeValidator blocklist) was already present in upstream version 2.17.0 before TuxCare onboarding. The fix commit 73c1c2cc76e by upstream maintainer Tatu Saloranta shipped in the upstream release, and the target version is far newer than the affected versions (before 2.9.10, 2.8.11.5, 2.6.7.3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2019-16942. The vulnerability, which affected versions 2.0.0 through 2.9.10, involved deserialization of malicious commons-dbcp datasource classes (SharedPoolDataSource and PerUserPoolDataSource) that could lead to arbitrary code execution. The fix was applied upstream in commit 9593e16cf5 and was already present in the 2.17.0 release that TuxCare onboarded. The vulnerable classes are blocklisted in SubTypeValidator.java, preventing their deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "The target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2019-16942. The vulnerability, which affected versions 2.0.0 through 2.9.10, involved deserialization of malicious commons-dbcp datasource classes (SharedPoolDataSource and PerUserPoolDataSource) that could lead to arbitrary code execution. The fix was applied upstream in commit 9593e16cf5 and was already present in the 2.17.0 release that TuxCare onboarded. The vulnerable classes are blocklisted in SubTypeValidator.java, preventing their deserialization when polymorphic typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version jackson-databind 2.17.0 is not affected by CVE-2019-16943. The vulnerability (polymorphic deserialization of P6DataSource gadget class enabling RCE) was fixed in the upstream jackson-databind project in September 2019 via commits 9593e16cf5 and 328a0f833d, which added com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes to the SubTypeValidator blocklist. This fix was already present in upstream version 2.17.0 (released 2024) when TuxCare onboarded it via commit ff3fad27c6. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "Target version jackson-databind 2.17.0 is not affected by CVE-2019-16943. The vulnerability (polymorphic deserialization of P6DataSource gadget class enabling RCE) was fixed in the upstream jackson-databind project in September 2019 via commits 9593e16cf5 and 328a0f833d, which added com.p6spy.engine.spy.P6DataSource and related commons-dbcp classes to the SubTypeValidator blocklist. This fix was already present in upstream version 2.17.0 (released 2024) when TuxCare onboarded it via commit ff3fad27c6. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.0-tuxcare.2) is NOT AFFECTED by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. The upstream fix (commit 191a4cdf87 by Tatu Saloranta) added this class to the SubTypeValidator blocklist at line 99, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.17.0 release that TuxCare onboarded, as confirmed by verifying that the fix commit is an ancestor of the first TuxCare commit (ff3fad27c6 \"Onboard version 2.17.0\"). The CVE affects versions before 2.9.10 and 2.8.11.5; version 2.17.0 is significantly newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "The target repository (jackson-databind 2.17.0-tuxcare.2) is NOT AFFECTED by CVE-2019-17267. The vulnerability involves polymorphic deserialization of the dangerous class `net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup`. The upstream fix (commit 191a4cdf87 by Tatu Saloranta) added this class to the SubTypeValidator blocklist at line 99, preventing its deserialization. This fix was already present in the upstream jackson-databind 2.17.0 release that TuxCare onboarded, as confirmed by verifying that the fix commit is an ancestor of the first TuxCare commit (ff3fad27c6 \"Onboard version 2.17.0\"). The CVE affects versions before 2.9.10 and 2.8.11.5; version 2.17.0 is significantly newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.0 is not affected by CVE-2019-17531. The fix for this polymorphic deserialization vulnerability was authored by upstream maintainer Tatu Saloranta in commit b5a304a985 and shipped in the upstream 2.17.0 release before TuxCare onboarded it. The two dangerous log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource) are present in the deserialization blacklist at SubTypeValidator.java lines 130-131, preventing arbitrary code execution when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "Target version 2.17.0 is not affected by CVE-2019-17531. The fix for this polymorphic deserialization vulnerability was authored by upstream maintainer Tatu Saloranta in commit b5a304a985 and shipped in the upstream 2.17.0 release before TuxCare onboarded it. The two dangerous log4j-extras classes (org.apache.log4j.receivers.db.JNDIConnectionSource and org.apache.log4j.receivers.db.DriverManagerConnectionSource) are present in the deserialization blacklist at SubTypeValidator.java lines 130-131, preventing arbitrary code execution when Default Typing is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.0 is not vulnerable to CVE-2019-20330. The vulnerability affects jackson-databind versions before 2.9.10.2, but version 2.17.0 already contains the upstream fix (commit fc4214a883 from 2019-11-01) that adds net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector to the deserialization blocklist. This fix was included in the upstream release before TuxCare onboarded the version, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "Target version 2.17.0 is not vulnerable to CVE-2019-20330. The vulnerability affects jackson-databind versions before 2.9.10.2, but version 2.17.0 already contains the upstream fix (commit fc4214a883 from 2019-11-01) that adds net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector to the deserialization blocklist. This fix was included in the upstream release before TuxCare onboarded the version, making this an upstream-provided fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.0-tuxcare.2) is NOT affected by CVE-2020-10650. The vulnerability involves unsafe deserialization of dangerous JNDI-related classes from ignite-jta and quartz libraries that could lead to remote code execution. The fix, which adds three class names to a deserialization blocklist (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider), was already present in the upstream Jackson 2.17.0 release before TuxCare onboarded it. The fix is present in SubTypeValidator.java lines 157-160 and was authored by the upstream maintainer Tatu Saloranta in commit a424c038ba.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target repository (jackson-databind 2.17.0-tuxcare.2) is NOT affected by CVE-2020-10650. The vulnerability involves unsafe deserialization of dangerous JNDI-related classes from ignite-jta and quartz libraries that could lead to remote code execution. The fix, which adds three class names to a deserialization blocklist (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, org.quartz.utils.JNDIConnectionProvider), was already present in the upstream Jackson 2.17.0 release before TuxCare onboarded it. The fix is present in SubTypeValidator.java lines 157-160 and was authored by the upstream maintainer Tatu Saloranta in commit a424c038ba.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.0-tuxcare.2) is not affected by CVE-2020-10672. The vulnerability, which involves deserialization of the malicious gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, has been mitigated by an upstream fix that was already present in version 2.17.0 before TuxCare onboarded it. The fix adds this class to Jackson's deserialization blocklist in SubTypeValidator.java at line 163, preventing exploitation of this deserialization gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "The target repository (jackson-databind 2.17.0-tuxcare.2) is not affected by CVE-2020-10672. The vulnerability, which involves deserialization of the malicious gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory, has been mitigated by an upstream fix that was already present in version 2.17.0 before TuxCare onboarded it. The fix adds this class to Jackson's deserialization blocklist in SubTypeValidator.java at line 163, preventing exploitation of this deserialization gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.17.0-tuxcare.2. The fix (blocklist entry for com.caucho.config.types.ResourceRef) was already present in the upstream 2.17.0 release when TuxCare onboarded it. The vulnerable deserialization gadget is blocked at line 167 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.17.0-tuxcare.2. The fix (blocklist entry for com.caucho.config.types.ResourceRef) was already present in the upstream 2.17.0 release when TuxCare onboarded it. The vulnerable deserialization gadget is blocked at line 167 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 is NOT present in jackson-databind 2.17.0. The vulnerability relates to unsafe deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 (March 2020) by adding the gadget classes to a blocklist in SubTypeValidator.java. Version 2.17.0, released much later, already contains this fix. The target's SubTypeValidator.java (lines 169-171) includes the exact blocklist entries from the vendor patch, preventing deserialization of the malicious classes. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 is NOT present in jackson-databind 2.17.0. The vulnerability relates to unsafe deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The upstream vendor (FasterXML) fixed this in version 2.9.10.4 (March 2020) by adding the gadget classes to a blocklist in SubTypeValidator.java. Version 2.17.0, released much later, already contains this fix. The target's SubTypeValidator.java (lines 169-171) includes the exact blocklist entries from the vendor patch, preventing deserialization of the malicious classes. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.17.0-tuxcare.2, which is much newer than the affected versions. The vulnerability involves unsafe deserialization of javax.swing.JEditorPane as a gadget class. The fix (adding javax.swing.JEditorPane to the deserialization blocklist in SubTypeValidator) is present in the target code at line 150 of SubTypeValidator.java. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream 2.17.0 release before TuxCare onboarded the project. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.17.0-tuxcare.2, which is much newer than the affected versions. The vulnerability involves unsafe deserialization of javax.swing.JEditorPane as a gadget class. The fix (adding javax.swing.JEditorPane to the deserialization blocklist in SubTypeValidator) is present in the target code at line 150 of SubTypeValidator.java. This fix was authored by the upstream maintainer Tatu Saloranta and shipped in the upstream 2.17.0 release before TuxCare onboarded the project. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for org.apache.activemq.* classes that enable polymorphic deserialization gadgets leading to RCE. The target (jackson-databind 2.17.0-tuxcare.2) is NOT vulnerable because all required activemq blocklist entries are present in SubTypeValidator.java. The fix was shipped in the upstream 2.17.0 release authored by upstream maintainer Tatu Saloranta, before TuxCare's onboarding. The vulnerable code pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for org.apache.activemq.* classes that enable polymorphic deserialization gadgets leading to RCE. The target (jackson-databind 2.17.0-tuxcare.2) is NOT vulnerable because all required activemq blocklist entries are present in SubTypeValidator.java. The fix was shipped in the upstream 2.17.0 release authored by upstream maintainer Tatu Saloranta, before TuxCare's onboarding. The vulnerable code pattern is absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability concerns a deserialization gadget (org.apache.commons.proxy.provider.remoting.RmiProvider) that can enable arbitrary code execution via polymorphic type handling. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 by adding the malicious class to SubTypeValidator's blocklist. This fix was already present in the upstream release when TuxCare onboarded the project at version 2.11.2, meaning the vulnerable pattern never existed in any TuxCare-maintained version. The blocklist entry is present at line 186 of SubTypeValidator.java and is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability concerns a deserialization gadget (org.apache.commons.proxy.provider.remoting.RmiProvider) that can enable arbitrary code execution via polymorphic type handling. The upstream vendor (FasterXML) fixed this in commit 05d7e0e13f43e12db6a51726df12c8b4d8040676 by adding the malicious class to SubTypeValidator's blocklist. This fix was already present in the upstream release when TuxCare onboarded the project at version 2.11.2, meaning the vulnerable pattern never existed in any TuxCare-maintained version. The blocklist entry is present at line 186 of SubTypeValidator.java and is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11113 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to SubTypeValidator's blacklist) was authored by upstream maintainer Tatu Saloranta in commit e2ba12d5d60715d95105e3e790fc234cfb59893d and shipped in upstream release 2.17.0, which TuxCare later onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "CVE-2020-11113 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization of the gadget class org.apache.openjpa.ee.WASRegistryManagedRuntime. The fix (adding this class to SubTypeValidator's blacklist) was authored by upstream maintainer Tatu Saloranta in commit e2ba12d5d60715d95105e3e790fc234cfb59893d and shipped in upstream release 2.17.0, which TuxCare later onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.springframework.aop.config.MethodLocatingFactoryBean. The target version 2.17.0-tuxcare.2 already contains the upstream vendor fix (commit 113e89fb08) which adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the SubTypeValidator blocklist at lines 53-54. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release 2.17.0 before TuxCare onboarded it. The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to unsafe deserialization of org.springframework.aop.config.MethodLocatingFactoryBean. The target version 2.17.0-tuxcare.2 already contains the upstream vendor fix (commit 113e89fb08) which adds MethodLocatingFactoryBean and BeanReferenceFactoryBean to the SubTypeValidator blocklist at lines 53-54. This fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the upstream release 2.17.0 before TuxCare onboarded it. The vulnerable deserialization pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the gadget class org.apache.commons.jelly.impl.Embedded. The target version 2.17.0-tuxcare.2 is NOT vulnerable because the upstream vendor (FasterXML) already fixed this vulnerability in their codebase before version 2.17.0. The blocklist entry is present at line 189 of SubTypeValidator.java, preventing deserialization of this malicious gadget class. This is an upstream fix that shipped in the original release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "CVE-2020-11620 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entry for the gadget class org.apache.commons.jelly.impl.Embedded. The target version 2.17.0-tuxcare.2 is NOT vulnerable because the upstream vendor (FasterXML) already fixed this vulnerability in their codebase before version 2.17.0. The blocklist entry is present at line 189 of SubTypeValidator.java, preventing deserialization of this malicious gadget class. This is an upstream fix that shipped in the original release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entries for the JNDI gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.17.0 contains the upstream fix (commit d1c67a03) that adds this class and related variants (org.apache.xalan.lib.sql.JNDIConnectionPool, shaded versions, and commons-dbcp datasource classes) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was shipped in the upstream 2.17.0 release before any TuxCare modifications, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to missing blocklist entries for the JNDI gadget class oadd.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version 2.17.0 contains the upstream fix (commit d1c67a03) that adds this class and related variants (org.apache.xalan.lib.sql.JNDIConnectionPool, shaded versions, and commons-dbcp datasource classes) to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was shipped in the upstream 2.17.0 release before any TuxCare modifications, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization gadgets using Oracle JMS classes (oracle.jms.AQjms*). The upstream fix (commit 5c8642aeae) adding these classes to the SubTypeValidator blocklist was already present in the upstream 2.17.0 release when TuxCare onboarded it. The vulnerable code pattern (allowing deserialization of these Oracle JMS classes) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization gadgets using Oracle JMS classes (oracle.jms.AQjms*). The upstream fix (commit 5c8642aeae) adding these classes to the SubTypeValidator blocklist was already present in the upstream 2.17.0 release when TuxCare onboarded it. The vulnerable code pattern (allowing deserialization of these Oracle JMS classes) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 affects jackson-databind versions before 2.9.10.5, involving deserialization of the xalan2 JNDI gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target repository version 2.17.0-tuxcare.2 contains the upstream fix (commit 840eae2ca81) that adds this class to the deserialization blocklist in SubTypeValidator.java (line 119). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream jackson-databind 2.17.0 release, which was onboarded by TuxCare. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 affects jackson-databind versions before 2.9.10.5, involving deserialization of the xalan2 JNDI gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool. The target repository version 2.17.0-tuxcare.2 contains the upstream fix (commit 840eae2ca81) that adds this class to the deserialization blocklist in SubTypeValidator.java (line 119). The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) and shipped in the upstream jackson-databind 2.17.0 release, which was onboarded by TuxCare. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 affects jackson-databind 2.x before 2.9.10.5 due to missing blacklist entry for org.jsecurity.realm.jndi.JndiRealmFactory. The target (version 2.17.0-tuxcare.2) contains the upstream fix: the dangerous class is blacklisted at SubTypeValidator.java:207 and validated during deserialization at line 269. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.17.0 release before TuxCare onboarding. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 affects jackson-databind 2.x before 2.9.10.5 due to missing blacklist entry for org.jsecurity.realm.jndi.JndiRealmFactory. The target (version 2.17.0-tuxcare.2) contains the upstream fix: the dangerous class is blacklisted at SubTypeValidator.java:207 and validated during deserialization at line 269. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the 2.17.0 release before TuxCare onboarding. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.17.0. The fix (blacklisting br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator) was already included in the upstream Jackson 2.17.0 release that TuxCare onboarded. The vulnerable deserialization gadget pattern is blocked by the hardcoded blacklist at SubTypeValidator.java:147, which is enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.17.0. The fix (blacklisting br.com.anteros.dbcp.AnterosDBCPDataSource in SubTypeValidator) was already included in the upstream Jackson 2.17.0 release that TuxCare onboarded. The vulnerable deserialization gadget pattern is blocked by the hardcoded blacklist at SubTypeValidator.java:147, which is enforced during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 affects jackson-databind versions before 2.9.10.6. The vulnerability involves unsafe deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class, allowing JNDI injection attacks. The target version 2.17.0 includes the upstream fix (commit 6cc9f1a1af) authored by Tatu Saloranta in July 2020 and released in jackson-databind 2.9.10.6. The fix adds JndiConfiguration to the deserialization blocklist in SubTypeValidator.java (lines 209-210), preventing instantiation of this dangerous class. This fix was already present in the upstream 2.17.0 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 affects jackson-databind versions before 2.9.10.6. The vulnerability involves unsafe deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class, allowing JNDI injection attacks. The target version 2.17.0 includes the upstream fix (commit 6cc9f1a1af) authored by Tatu Saloranta in July 2020 and released in jackson-databind 2.9.10.6. The fix adds JndiConfiguration to the deserialization blocklist in SubTypeValidator.java (lines 209-210), preventing instantiation of this dangerous class. This fix was already present in the upstream 2.17.0 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 is not present in jackson-databind 2.17.0-tuxcare.2. The XXE vulnerability in DOMDeserializer was fixed by upstream commit 612f971b78 (authored by Tatu Saloranta) which was already included in the upstream 2.17.0 release before TuxCare onboarded it. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XML external entity attacks. The defense code is present at DOMDeserializer.java lines 40-46 and actively applied at runtime via DEFAULT_PARSER_FACTORY.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 is not present in jackson-databind 2.17.0-tuxcare.2. The XXE vulnerability in DOMDeserializer was fixed by upstream commit 612f971b78 (authored by Tatu Saloranta) which was already included in the upstream 2.17.0 release before TuxCare onboarded it. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XML external entity attacks. The defense code is present at DOMDeserializer.java lines 40-46 and actively applied at runtime via DEFAULT_PARSER_FACTORY.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2020-35490. The fix (blocklist entries for org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) was already present in the upstream release 2.17.0 when TuxCare onboarded it. The vulnerable deserialization gadget pattern does not exist in this version because the upstream vendor (Tatu Saloranta) included the fix in commit 41b8bdb5cc before the 2.17.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "Target jackson-databind 2.17.0-tuxcare.2 is NOT AFFECTED by CVE-2020-35490. The fix (blocklist entries for org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource) was already present in the upstream release 2.17.0 when TuxCare onboarded it. The vulnerable deserialization gadget pattern does not exist in this version because the upstream vendor (Tatu Saloranta) included the fix in commit 41b8bdb5cc before the 2.17.0 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.17.0-tuxcare.1. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) added org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.17.0 release before TuxCare onboarded it (onboarding commit ff3fad27c6 by amoniatovskiy@cloudlinux.com). The blocklist defense is active and prevents deserialization of these dangerous classes via the validateSubType() method called during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.17.0-tuxcare.1. The upstream fix (commit 41b8bdb5cc by Tatu Saloranta) added org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream 2.17.0 release before TuxCare onboarded it (onboarding commit ff3fad27c6 by amoniatovskiy@cloudlinux.com). The blocklist defense is active and prevents deserialization of these dangerous classes via the validateSubType() method called during polymorphic type handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget vulnerability involving com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version (2.17.0-tuxcare.2) already contains the upstream fix that adds this class to the SubTypeValidator blacklist, preventing its deserialization. The fix was authored by upstream developer Tatu Saloranta and was included in the upstream 2.17.0 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 affects jackson-databind versions before 2.9.10.8 due to a deserialization gadget vulnerability involving com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool. The target version (2.17.0-tuxcare.2) already contains the upstream fix that adds this class to the SubTypeValidator blacklist, preventing its deserialization. The fix was authored by upstream developer Tatu Saloranta and was included in the upstream 2.17.0 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, allowing deserialization of dangerous DriverAdapterCPDS classes that enable remote code execution. The target version 2.17.0-tuxcare.2 is not affected because the upstream fix (commit 3ded28aece by Tatu Saloranta, Dec 31 2020) was already included in the 2.17.0 release that TuxCare onboarded. All five DriverAdapterCPDS blocklist entries are present in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 affects jackson-databind versions before 2.9.10.8, allowing deserialization of dangerous DriverAdapterCPDS classes that enable remote code execution. The target version 2.17.0-tuxcare.2 is not affected because the upstream fix (commit 3ded28aece by Tatu Saloranta, Dec 31 2020) was already included in the 2.17.0 release that TuxCare onboarded. All five DriverAdapterCPDS blocklist entries are present in SubTypeValidator.java and actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36180 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization gadgets related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The upstream fix (commit 3ded28aece) added this class to the SubTypeValidator blacklist in version 2.9.10.8. The target version 2.17.0 is much newer and already includes this fix as part of the upstream release that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) and was present before TuxCare's first commit (ff3fad27c \"Onboard version 2.17.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "CVE-2020-36180 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization gadgets related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. The upstream fix (commit 3ded28aece) added this class to the SubTypeValidator blacklist in version 2.9.10.8. The target version 2.17.0 is much newer and already includes this fix as part of the upstream release that TuxCare onboarded. The fix was authored by Tatu Saloranta (upstream maintainer) and was present before TuxCare's first commit (ff3fad27c \"Onboard version 2.17.0\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.17.0-tuxcare.2 is NOT vulnerable. The fix (commit 3ded28aece) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.17.0 release before TuxCare onboarded it. The dangerous class is properly blocklisted in SubTypeValidator.java at line 228, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 affects jackson-databind versions before 2.9.10.8, involving deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The target version 2.17.0-tuxcare.2 is NOT vulnerable. The fix (commit 3ded28aece) was authored by upstream maintainer Tatu Saloranta and was already present in the upstream 2.17.0 release before TuxCare onboarded it. The dangerous class is properly blocklisted in SubTypeValidator.java at line 228, preventing its deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 does not affect jackson-databind 2.17.0-tuxcare.2. The vulnerability concerns polymorphic deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which could enable remote code execution. Upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding the class to SubTypeValidator's deserialization blocklist. This fix was already present in upstream version 2.17.0 when TuxCare onboarded it (commit ff3fad27c6). The blocklist entry exists at SubTypeValidator.java:234, preventing instantiation of the dangerous class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 does not affect jackson-databind 2.17.0-tuxcare.2. The vulnerability concerns polymorphic deserialization of org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, which could enable remote code execution. Upstream vendor (FasterXML) fixed this in commit 3ded28aece by adding the class to SubTypeValidator's deserialization blocklist. This fix was already present in upstream version 2.17.0 when TuxCare onboarded it (commit ff3fad27c6). The blocklist entry exists at SubTypeValidator.java:234, preventing instantiation of the dangerous class during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability relates to unsafe deserialization of org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which could allow arbitrary code execution through JNDI injection. The upstream fix (commit 12e23c962f by Tatu Saloranta on 2020-12-31) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its deserialization. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded (commit ff3fad27c6), meaning the vulnerable code pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability relates to unsafe deserialization of org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, which could allow arbitrary code execution through JNDI injection. The upstream fix (commit 12e23c962f by Tatu Saloranta on 2020-12-31) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing its deserialization. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded (commit ff3fad27c6), meaning the vulnerable code pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes. The target version 2.17.0 is NOT affected because the upstream fix (commit 567194c53a, dated 2020-12-26) is present in SubTypeValidator.java lines 235-236, where both vulnerable classes are blocklisted. This fix was authored by upstream maintainer Tatu Saloranta and shipped in version 2.9.10.8, well before the 2.17.0 release that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource gadget classes. The target version 2.17.0 is NOT affected because the upstream fix (commit 567194c53a, dated 2020-12-26) is present in SubTypeValidator.java lines 235-236, where both vulnerable classes are blocklisted. This fix was authored by upstream maintainer Tatu Saloranta and shipped in version 2.9.10.8, well before the 2.17.0 release that TuxCare onboarded. The vulnerable deserialization pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT PRESENT in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and related classes). The fix, which adds these classes to a blocklist in SubTypeValidator.java, was applied by upstream maintainer Tatu Saloranta on 2020-12-26 (commit 567194c53a) and shipped with the upstream 2.17.0 release (March 2024), predating TuxCare's onboarding by over 3 years. The target repository contains the complete fix with all CVE-mentioned classes blocked at lines 232-236 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is NOT PRESENT in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves Jackson's polymorphic deserialization allowing instantiation of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and related classes). The fix, which adds these classes to a blocklist in SubTypeValidator.java, was applied by upstream maintainer Tatu Saloranta on 2020-12-26 (commit 567194c53a) and shipped with the upstream 2.17.0 release (March 2024), predating TuxCare's onboarding by over 3 years. The target repository contains the complete fix with all CVE-mentioned classes blocked at lines 232-236 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for dangerous deserialization gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource). The target repository at version 2.17.0 is NOT AFFECTED because the upstream vendor (Tatu Saloranta) applied the fix in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 on 2020-12-26, which was already included in the upstream 2.17.0 release that TuxCare onboarded on 2026-09-21. The vulnerable classes are present in the blocklist at SubTypeValidator.java lines 229-230, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 affects jackson-databind versions before 2.9.10.8 due to missing blocklist entries for dangerous deserialization gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource). The target repository at version 2.17.0 is NOT AFFECTED because the upstream vendor (Tatu Saloranta) applied the fix in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 on 2020-12-26, which was already included in the upstream 2.17.0 release that TuxCare onboarded on 2026-09-21. The vulnerable classes are present in the blocklist at SubTypeValidator.java lines 229-230, preventing their deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version is 2.17.0-tuxcare.2, which already includes the upstream fix. The vulnerable classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java (lines 229-230). This fix was authored by upstream maintainer Tatu Saloranta in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 and was included in jackson-databind 2.9.10.8, released in December 2020. The fix was already present in the upstream release 2.17.0 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8. The target version is 2.17.0-tuxcare.2, which already includes the upstream fix. The vulnerable classes org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource are blocked in the DEFAULT_NO_DESER_CLASS_NAMES set in SubTypeValidator.java (lines 229-230). This fix was authored by upstream maintainer Tatu Saloranta in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 and was included in jackson-databind 2.9.10.8, released in December 2020. The fix was already present in the upstream release 2.17.0 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.17.0-tuxcare.2) is not affected by CVE-2020-36188. The vulnerability, which allowed remote code execution through deserialization of malicious com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource gadget classes, was fixed in upstream commit 33d96c13fe by adding these class names to the deserialization blocklist. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded, before any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "The target repository (jackson-databind 2.17.0-tuxcare.2) is not affected by CVE-2020-36188. The vulnerability, which allowed remote code execution through deserialization of malicious com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource gadget classes, was fixed in upstream commit 33d96c13fe by adding these class names to the deserialization blocklist. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded, before any TuxCare-specific modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.17.0. The vulnerability concerns deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db classes (JNDIConnectionSource and DriverManagerConnectionSource) that could enable unauthorized operations via polymorphic typing. The upstream vendor (FasterXML) fixed this by adding both classes to the SubTypeValidator blocklist in commit 33d96c13 on 2020-12-26. This fix is present in the target at SubTypeValidator.java lines 221-224. The fix was committed by the upstream maintainer Tatu Saloranta nearly 5 years before TuxCare onboarded version 2.11.2, meaning it shipped in the upstream release. Target version 2.17.0 is far beyond the affected range (before 2.9.10.8) and contains the complete upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.17.0. The vulnerability concerns deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db classes (JNDIConnectionSource and DriverManagerConnectionSource) that could enable unauthorized operations via polymorphic typing. The upstream vendor (FasterXML) fixed this by adding both classes to the SubTypeValidator blocklist in commit 33d96c13 on 2020-12-26. This fix is present in the target at SubTypeValidator.java lines 221-224. The fix was committed by the upstream maintainer Tatu Saloranta nearly 5 years before TuxCare onboarded version 2.11.2, meaning it shipped in the upstream release. Target version 2.17.0 is far beyond the affected range (before 2.9.10.8) and contains the complete upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerable recursive deserialization code (UntypedObjectDeserializer.Vanilla) was replaced with an iterative implementation (UntypedObjectDeserializerNR) in upstream version 2.14 (commit 8238ab41d0), preventing Java stack overflow. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded. The target uses UntypedObjectDeserializerNR by default, which processes deeply nested JSON iteratively rather than recursively, eliminating the stack overflow vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerable recursive deserialization code (UntypedObjectDeserializer.Vanilla) was replaced with an iterative implementation (UntypedObjectDeserializerNR) in upstream version 2.14 (commit 8238ab41d0), preventing Java stack overflow. This fix was already present in the upstream 2.17.0 release that TuxCare onboarded. The target uses UntypedObjectDeserializerNR by default, which processes deeply nested JSON iteratively rather than recursively, eliminating the stack overflow vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves missing blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, allowing polymorphic deserialization gadget attacks. The fix (adding JndiConverter to DEFAULT_NO_DESER_CLASS_NAMES blocklist) was applied by upstream maintainer Tatu Saloranta in commit 914e7c9f on Feb 9, 2020, and shipped in the upstream 2.17.0 release that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:138 prevents deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves missing blocklist protection for org.apache.xbean.propertyeditor.JndiConverter, allowing polymorphic deserialization gadget attacks. The fix (adding JndiConverter to DEFAULT_NO_DESER_CLASS_NAMES blocklist) was applied by upstream maintainer Tatu Saloranta in commit 914e7c9f on Feb 9, 2020, and shipped in the upstream 2.17.0 release that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:138 prevents deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.17.0-tuxcare.2 is NOT affected by CVE-2020-9546. The vulnerability pattern (missing blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) is not present because the upstream fix was already included in the jackson-databind 2.17.0 release before TuxCare onboarding. The gadget class is properly blocked at line 141 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target repository jackson-databind version 2.17.0-tuxcare.2 is NOT affected by CVE-2020-9546. The vulnerability pattern (missing blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig) is not present because the upstream fix was already included in the jackson-databind 2.17.0 release before TuxCare onboarding. The gadget class is properly blocked at line 141 of SubTypeValidator.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerable deserialization gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` is blocklisted in SubTypeValidator.java at line 144. This fix was introduced in upstream jackson-databind 2.9.10.4 (February 2020) and shipped with upstream 2.17.0 (March 2024), which TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerable deserialization gadget class `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` is blocklisted in SubTypeValidator.java at line 144. This fix was introduced in upstream jackson-databind 2.9.10.4 (February 2020) and shipped with upstream 2.17.0 (March 2024), which TuxCare subsequently onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2020-9548. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java line 145) was already present in the upstream Jackson 2.17.0 release when TuxCare onboarded it. The fix commit (1e64db6a2f) was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-02-29 and predates the first TuxCare commit in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "The target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2020-9548. The vulnerability involves unsafe deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class, which could lead to arbitrary code execution. The fix (adding this class to the deserialization blocklist in SubTypeValidator.java line 145) was already present in the upstream Jackson 2.17.0 release when TuxCare onboarded it. The fix commit (1e64db6a2f) was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2020-02-29 and predates the first TuxCare commit in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization gadgets (javax.swing.JTextPane and others) that can be exploited via polymorphic typing. The upstream vendor (FasterXML) fixed this vulnerability in commit 7dbf51bf78 (September 2020) by adding gadget class names to the SubTypeValidator deny list. This fix was already included in the upstream 2.17.0 release that TuxCare onboarded. The target's SubTypeValidator.java at line 151 contains the blocking entry for javax.swing.JTextPane and a comprehensive deny list of all other gadget classes from the patches. The validateSubType() method actively rejects any attempt to deserialize these blocked classes, preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.17.0-tuxcare.2. The vulnerability involves deserialization gadgets (javax.swing.JTextPane and others) that can be exploited via polymorphic typing. The upstream vendor (FasterXML) fixed this vulnerability in commit 7dbf51bf78 (September 2020) by adding gadget class names to the SubTypeValidator deny list. This fix was already included in the upstream 2.17.0 release that TuxCare onboarded. The target's SubTypeValidator.java at line 151 contains the blocking entry for javax.swing.JTextPane and a comprehensive deny list of all other gadget classes from the patches. The validateSubType() method actively rejects any attempt to deserialize these blocked classes, preventing the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2021-46877. The vulnerability involved unbounded heap allocation during JDK deserialization of JsonNode objects, where malicious input could specify a very large length field causing immediate allocation of up to 2GB of heap memory. The upstream fix (commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta) was already present in the upstream 2.17.0 release before TuxCare onboarded it. The fix implements segmented allocation with a 100KB eager allocation limit\u2014larger data is read in chunks using ByteArrayBuilder rather than allocating the full claimed size upfront. This defensive pattern is present in the target at NodeSerialization.java:18-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "The target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2021-46877. The vulnerability involved unbounded heap allocation during JDK deserialization of JsonNode objects, where malicious input could specify a very large length field causing immediate allocation of up to 2GB of heap memory. The upstream fix (commit 3ccde7d938fea547e598fdefe9a82cff37fed5cb by Tatu Saloranta) was already present in the upstream 2.17.0 release before TuxCare onboarded it. The fix implements segmented allocation with a 100KB eager allocation limit\u2014larger data is read in chunks using ByteArrayBuilder rather than allocating the full claimed size upfront. This defensive pattern is present in the target at NodeSerialization.java:18-84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. jackson-databind version 2.17.0 is NOT AFFECTED by CVE-2022-42003. The vulnerability (resource exhaustion via deep array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0. Since 2.17.0 was released after 2.14.0, it already contains the fix from the upstream vendor. The defensive code (`handleNestedArrayForSingle` checks in primitive deserializers and BeanDeserializer) is present in the target codebase, having shipped with the upstream 2.17.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "jackson-databind version 2.17.0 is NOT AFFECTED by CVE-2022-42003. The vulnerability (resource exhaustion via deep array nesting when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream version 2.14.0. Since 2.17.0 was released after 2.14.0, it already contains the fix from the upstream vendor. The defensive code (`handleNestedArrayForSingle` checks in primitive deserializers and BeanDeserializer) is present in the target codebase, having shipped with the upstream 2.17.0 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. Target version 2.17.0-tuxcare.2 is not affected by CVE-2022-42004. The vulnerability involves resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was already present in the upstream jackson-databind 2.17.0 release that TuxCare onboarded. The defense code in BeanDeserializer._deserializeFromArray() (lines 636-644) checks for nested START_ARRAY tokens and rejects them before recursive deserialization, preventing the resource exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "Target version 2.17.0-tuxcare.2 is not affected by CVE-2022-42004. The vulnerability involves resource exhaustion from deeply nested arrays when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. The upstream fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by Tatu Saloranta) was already present in the upstream jackson-databind 2.17.0 release that TuxCare onboarded. The defense code in BeanDeserializer._deserializeFromArray() (lines 636-644) checks for nested START_ARRAY tokens and rejects them before recursive deserialization, preventing the resource exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2026-50193. The vulnerability fix (commit a1fa4ae4ec by Tatu Saloranta) was already included in the upstream 2.17.0 release that TuxCare onboarded. The fix converts recursive JsonNode serialization in InternalNodeMapper.java to an iterative approach using IteratorStack, preventing stack exhaustion from deeply nested JSON structures...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 Target jackson-databind 2.17.0-tuxcare.2 is not affected by CVE-2026-50193. The vulnerability fix (commit a1fa4ae4ec by Tatu Saloranta) was already included in the upstream 2.17.0 release that TuxCare onboarded. The fix converts recursive JsonNode serialization in InternalNodeMapper.java to an iterative approach using IteratorStack, preventing stack exhaustion from deeply nested JSON structures..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.17.0 is not affected by CVE-2026-54518. The vulnerability requires the combination of @JsonUnwrapped with @JsonCreator parameters to bypass @JsonView restrictions. This combination is explicitly unsupported in version 2.17.0\u2014the code throws an exception during deserialization setup. The vulnerable method processUnwrappedCreatorProperties() does not exist in this version; it was introd...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.17.0 is not affected by CVE-2026-54518. The vulnerability requires the combination of @JsonUnwrapped with @JsonCreator parameters to bypass @JsonView restrictions. This combination is explicitly unsupported in version 2.17.0\u2014the code throws an exception during deserialization setup. The vulnerable method processUnwrappedCreatorProperties() does not exist in this version; it was introd..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.17.0-tuxcare.3 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:39:30.987552+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.17.0-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}