{
  "@id": "urn:uuid:d67d1983-5c4a-40e4-8b57-4f2b92ff8208",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 60,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:23:21.346897+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability, which allowed code execution via deserialization of malicious classes, was fixed in upstream commits ddfddfba64 (issue #1737) and e8f043d1aa (issue #1680). These fixes add comprehensive blacklisting of dangerous classes in SubTypeValidator.java, including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and various Spring/C3P0 classes. Both fix commits were authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) and were already present in the upstream release 2.19.2 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability, which allowed code execution via deserialization of malicious classes, was fixed in upstream commits ddfddfba64 (issue #1737) and e8f043d1aa (issue #1680). These fixes add comprehensive blacklisting of dangerous classes in SubTypeValidator.java, including java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, com.sun.rowset.JdbcRowSetImpl, and various Spring/C3P0 classes. Both fix commits were authored by the upstream Jackson maintainer (tatu.saloranta@iki.fi) and were already present in the upstream release 2.19.2 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:50:08.266665+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 affects jackson-databind versions through 2.8.10 and 2.9.x through 2.9.3. The target is version 2.19.2, which already contains the complete upstream fix. The vulnerability involved bypassing deserialization blacklists when Spring libraries are available. The fix added multiple dangerous classes to the blacklist in SubTypeValidator (issues #1737, #1855) and implemented special validation logic for Spring class hierarchies. All fix commits (bb45fb16, 2235894210, f031f27a, e865a7a4, etc.) were authored by upstream FasterXML developers and shipped in the upstream 2.19.2 release that TuxCare onboarded. The SubTypeValidator is called unconditionally during bean deserialization and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 affects jackson-databind versions through 2.8.10 and 2.9.x through 2.9.3. The target is version 2.19.2, which already contains the complete upstream fix. The vulnerability involved bypassing deserialization blacklists when Spring libraries are available. The fix added multiple dangerous classes to the blacklist in SubTypeValidator (issues #1737, #1855) and implemented special validation logic for Spring class hierarchies. All fix commits (bb45fb16, 2235894210, f031f27a, e865a7a4, etc.) were authored by upstream FasterXML developers and shipped in the upstream 2.19.2 release that TuxCare onboarded. The SubTypeValidator is called unconditionally during bean deserialization and cannot be bypassed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:39:42.552241+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9, allowing arbitrary code execution via deserialization of dangerous classes when polymorphic typing is enabled. The target repository (jackson-databind 2.19.2-tuxcare.2) is NOT AFFECTED because the upstream vendor fix was already present in the 2.19.2 release before TuxCare onboarding. The fix implements SubTypeValidator with a comprehensive blacklist of dangerous classes (including TemplatesImpl from the CVE) and validates all bean deserialization attempts, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9, allowing arbitrary code execution via deserialization of dangerous classes when polymorphic typing is enabled. The target repository (jackson-databind 2.19.2-tuxcare.2) is NOT AFFECTED because the upstream vendor fix was already present in the 2.19.2 release before TuxCare onboarding. The fix implements SubTypeValidator with a comprehensive blacklist of dangerous classes (including TemplatesImpl from the CVE) and validates all bean deserialization attempts, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:25:51.798724+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involved deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser for data exfiltration via XXE. The fix (blacklisting this class in SubTypeValidator.java) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc27 and shipped in upstream release 2.19.2, which TuxCare then onboarded. The blacklist entry is present at line 65 of SubTypeValidator.java, preventing exploitation of this attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involved deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser for data exfiltration via XXE. The fix (blacklisting this class in SubTypeValidator.java) was applied by upstream maintainer Tatu Saloranta in commit 27b4defc27 and shipped in upstream release 2.19.2, which TuxCare then onboarded. The blacklist entry is present at line 65 of SubTypeValidator.java, preventing exploitation of this attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 is not present in jackson-databind 2.19.2. The upstream fix was already included in the 2.19.2 release onboarded by TuxCare. The SubTypeValidator blacklist contains the required entries blocking deserialization of jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet, preventing the polymorphic deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 is not present in jackson-databind 2.19.2. The upstream fix was already included in the 2.19.2 release onboarded by TuxCare. The SubTypeValidator blacklist contains the required entries blocking deserialization of jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, and oracle.jdbc.rowset.OracleJDBCRowSet, preventing the polymorphic deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:29:44.182918+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.19.2-tuxcare.2. The Oracle JDBC deserialization gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are already blacklisted in SubTypeValidator.java (lines 71-72). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind release before TuxCare onboarded version 2.19.2. The validateSubType method enforces this blacklist during deserialization, preventing exploitation of the JNDI/LDAP lookup vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.19.2-tuxcare.2. The Oracle JDBC deserialization gadget classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) are already blacklisted in SubTypeValidator.java (lines 71-72). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream jackson-databind release before TuxCare onboarded version 2.19.2. The validateSubType method enforces this blacklist during deserialization, preventing exploitation of the JNDI/LDAP lookup vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:06:34.485186+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.19.2-tuxcare.2. The fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 that blocks org.slf4j.ext.EventData and three other dangerous classes from polymorphic deserialization is present in HEAD's ancestry and was already included in the upstream release 2.19.2 that TuxCare onboarded. The blocklist entries are located in SubTypeValidator.java (lines 75-78) and enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.19.2-tuxcare.2. The fix commit 87d29af25e82a249ea15858e2d4ecbf64091db44 that blocks org.slf4j.ext.EventData and three other dangerous classes from polymorphic deserialization is present in HEAD's ancestry and was already included in the upstream release 2.19.2 that TuxCare onboarded. The blocklist entries are located in SubTypeValidator.java (lines 75-78) and enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:06:30.945793+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 by allowing arbitrary code execution through polymorphic deserialization of BlazeDS classes (flex.messaging package). The target repository is version 2.19.2-tuxcare.2, which already contains the upstream fix (commit 87d29af25e) that blocks dangerous classes including 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was present in the upstream release 2.19.2 before TuxCare onboarding (commit 728babb449), so the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 affects jackson-databind versions before 2.9.7, 2.8.11.3, and 2.7.9.5 by allowing arbitrary code execution through polymorphic deserialization of BlazeDS classes (flex.messaging package). The target repository is version 2.19.2-tuxcare.2, which already contains the upstream fix (commit 87d29af25e) that blocks dangerous classes including 'flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor' via the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was present in the upstream release 2.19.2 before TuxCare onboarding (commit 728babb449), so the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:12:02.519749+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.2 is not affected by CVE-2018-14720. The four dangerous classes specified in the patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java and actively blocked during polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.19.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "Target version 2.19.2 is not affected by CVE-2018-14720. The four dangerous classes specified in the patch (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java and actively blocked during polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.19.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:41:24.721852+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14721 is NOT present in jackson-databind 2.19.2. The vulnerability affects versions before 2.9.7. The target version 2.19.2 includes the upstream fix (commit 87d29af25e) that blocks the dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization via a blocklist in SubTypeValidator. This fix was shipped with the upstream release 2.19.2 before TuxCare onboarded it, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "CVE-2018-14721 is NOT present in jackson-databind 2.19.2. The vulnerability affects versions before 2.9.7. The target version 2.19.2 includes the upstream fix (commit 87d29af25e) that blocks the dangerous class org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl from polymorphic deserialization via a blocklist in SubTypeValidator. This fix was shipped with the upstream release 2.19.2 before TuxCare onboarded it, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository is jackson-databind version 2.19.2-tuxcare.1, which already contains the upstream fix. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a229fb28ec133235003dd4616f70afaa and was present in the upstream 2.19.2 release before TuxCare onboarded it. The vulnerable class is blocked at line 85 of SubTypeValidator.java, preventing its instantiation during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 by allowing polymorphic deserialization of the dangerous class org.apache.axis2.transport.jms.JMSOutTransportInfo. The target repository is jackson-databind version 2.19.2-tuxcare.1, which already contains the upstream fix. The fix was authored by upstream maintainer Tatu Saloranta in commit 72cd4025a229fb28ec133235003dd4616f70afaa and was present in the upstream 2.19.2 release before TuxCare onboarded it. The vulnerable class is blocked at line 85 of SubTypeValidator.java, preventing its instantiation during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:24.314148+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.2 is not affected by CVE-2018-19361. The upstream FasterXML jackson-databind project fixed this vulnerability in version 2.9.8 (November 2018) by adding org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the polymorphic deserialization blocklist in SubTypeValidator.java. These blocklist entries were already present in the upstream 2.19.2 release that TuxCare onboarded, preventing the deserialization of dangerous openjpa gadget classes. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the release, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "Target version 2.19.2 is not affected by CVE-2018-19361. The upstream FasterXML jackson-databind project fixed this vulnerability in version 2.9.8 (November 2018) by adding org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the polymorphic deserialization blocklist in SubTypeValidator.java. These blocklist entries were already present in the upstream 2.19.2 release that TuxCare onboarded, preventing the deserialization of dangerous openjpa gadget classes. The fix was authored by Tatu Saloranta (upstream maintainer) and shipped in the release, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, 2018-11-19) added this class to the deserialization blocklist in SubTypeValidator.java and was already present in the upstream version 2.19.2 that TuxCare onboarded. The target code at lines 81-85 of SubTypeValidator.java contains the blocklist entries that prevent deserialization of the dangerous classes, and the validateSubType method actively enforces this blocklist at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns polymorphic deserialization of the jboss-common-core class org.jboss.util.propertyeditor.DocumentEditor. The upstream fix (commit 72cd4025a2 by Tatu Saloranta, 2018-11-19) added this class to the deserialization blocklist in SubTypeValidator.java and was already present in the upstream version 2.19.2 that TuxCare onboarded. The target code at lines 81-85 of SubTypeValidator.java contains the blocklist entries that prevent deserialization of the dangerous classes, and the validateSubType method actively enforces this blocklist at line 269.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed prior blacklist protections. The upstream vendor (FasterXML) fixed this in commit 038b471e2e by adding both classes to the SubTypeValidator blacklist. This fix was already present in the upstream jackson-databind 2.19.2 release before TuxCare onboarded it (first TuxCare commit: 728babb449 \"Onboard version 2.19.2\"). The target contains the fix at SubTypeValidator.java:62-63, and the blacklist is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involved two deserialization gadgets (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that bypassed prior blacklist protections. The upstream vendor (FasterXML) fixed this in commit 038b471e2e by adding both classes to the SubTypeValidator blacklist. This fix was already present in the upstream jackson-databind 2.19.2 release before TuxCare onboarded it (first TuxCare commit: 728babb449 \"Onboard version 2.19.2\"). The target contains the fix at SubTypeValidator.java:62-63, and the blacklist is actively enforced during deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:05:55.116892+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 (c3p0 deserialization RCE) is NOT present in jackson-databind 2.19.2-tuxcare.2. The upstream fix (commit 6799f8f10c) was included in upstream release 2.19.2, which TuxCare onboarded. The defense validates class names before deserialization and rejects any c3p0 DataSource classes (pattern: com.mchange.v2.c3p0.*DataSource). The vulnerable code pattern has been removed by the upstream vendor, so the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 (c3p0 deserialization RCE) is NOT present in jackson-databind 2.19.2-tuxcare.2. The upstream fix (commit 6799f8f10c) was included in upstream release 2.19.2, which TuxCare onboarded. The defense validates class names before deserialization and rejects any c3p0 DataSource classes (pattern: com.mchange.v2.c3p0.*DataSource). The vulnerable code pattern has been removed by the upstream vendor, so the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:38:23.121558+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 does not affect jackson-databind 2.19.2-tuxcare.2. The upstream fix that adds com.mysql.cj.jdbc.admin.MiniAdmin to the polymorphic deserialization blacklist was already present in the upstream 2.19.2 release when TuxCare onboarded it. The vulnerable code pattern (missing MiniAdmin validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 does not affect jackson-databind 2.19.2-tuxcare.2. The upstream fix that adds com.mysql.cj.jdbc.admin.MiniAdmin to the polymorphic deserialization blacklist was already present in the upstream 2.19.2 release when TuxCare onboarded it. The vulnerable code pattern (missing MiniAdmin validation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T18:57:00.102490+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target repository is NOT vulnerable to CVE-2019-12384. The fix that blocks ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization is present in SubTypeValidator.java at line 91. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c9ef4a10d6 and was already included in the upstream release 2.19.2 before TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 The target repository is NOT vulnerable to CVE-2019-12384. The fix that blocks ch.qos.logback.core.db.DriverManagerConnectionSource from polymorphic deserialization is present in SubTypeValidator.java at line 91. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit c9ef4a10d6 and was already included in the upstream release 2.19.2 before TuxCare onboarde..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T07:37:00.159436+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization of JDOM XSLTransformer classes via polymorphic typing to read arbitrary local files. The upstream vendor fix (commit 5f7c69bba0 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization of JDOM XSLTransformer classes via polymorphic typing to read arbitrary local files. The upstream vendor fix (commit 5f7c69bba0 by Tatu Saloranta) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6 due to missing blocklist entries for dangerous ehcache classes. The target repository (jackson-databind 2.19.2-tuxcare.1) already contains the upstream fix that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blocklist. This fix was authored by upstream maintainer Tatu Saloranta in commit ad418eeb97 and was already present in the upstream 2.19.2 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 affects jackson-databind versions before 2.9.9.2, 2.8.11.4, and 2.7.9.6 due to missing blocklist entries for dangerous ehcache classes. The target repository (jackson-databind 2.19.2-tuxcare.1) already contains the upstream fix that adds net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blocklist. This fix was authored by upstream maintainer Tatu Saloranta in commit ad418eeb97 and was already present in the upstream 2.19.2 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:53:55.157124+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind's polymorphic deserialization when Default Typing is enabled with logback jar in classpath. The vulnerability allows RCE through JNDI injection via ch.qos.logback.core.db.JNDIConnectionSource. The upstream fix (commit ad418eeb97 by Tatu Saloranta, July 25, 2019) added blocklist entries to SubTypeValidator.java. Target version 2.19.2-tuxcare.2 already contains both required blocklist entries (lines 98, 102) because the fix was included in upstream release 2.10.0, shipped long before TuxCare onboarded version 2.19.2. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind's polymorphic deserialization when Default Typing is enabled with logback jar in classpath. The vulnerability allows RCE through JNDI injection via ch.qos.logback.core.db.JNDIConnectionSource. The upstream fix (commit ad418eeb97 by Tatu Saloranta, July 25, 2019) added blocklist entries to SubTypeValidator.java. Target version 2.19.2-tuxcare.2 already contains both required blocklist entries (lines 98, 102) because the fix was included in upstream release 2.10.0, shipped long before TuxCare onboarded version 2.19.2. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:54:24.400671+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 (polymorphic typing issue with com.zaxxer.hikari.HikariConfig) is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability was fixed in upstream version 2.9.10, and version 2.19.2 is significantly newer. The fix (adding HikariConfig and HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator) was already present in the upstream release when TuxCare onboarded version 2.19.2. Both fix commits (d4983c740f, 73c1c2cc76) authored by upstream maintainer Tatu Saloranta are ancestors of HEAD and came before the first TuxCare commit (728babb449 \"Onboard version 2.19.2\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 (polymorphic typing issue with com.zaxxer.hikari.HikariConfig) is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability was fixed in upstream version 2.9.10, and version 2.19.2 is significantly newer. The fix (adding HikariConfig and HikariDataSource to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator) was already present in the upstream release when TuxCare onboarded version 2.19.2. Both fix commits (d4983c740f, 73c1c2cc76) authored by upstream maintainer Tatu Saloranta are ancestors of HEAD and came before the first TuxCare commit (728babb449 \"Onboard version 2.19.2\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:02:25.196465+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.2 is not affected by CVE-2019-14892. The upstream fix that blocks deserialization of org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration classes was already present in the upstream release 2.19.2 when TuxCare onboarded it. The vulnerable code pattern (unrestricted polymorphic deserialization of these JNDI classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "The target jackson-databind 2.19.2 is not affected by CVE-2019-14892. The upstream fix that blocks deserialization of org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration classes was already present in the upstream release 2.19.2 when TuxCare onboarded it. The vulnerable code pattern (unrestricted polymorphic deserialization of these JNDI classes) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository is NOT vulnerable to CVE-2019-14893. The upstream fix (commit 998efd7082 by Tatu Saloranta) was already present in jackson-databind version 2.19.2 when TuxCare onboarded it. The fix adds org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blocklist, preventing polymorphic deserialization of this JNDI gadget class. The blocklist is checked before object instantiation during bean deserialization, effectively blocking the attack vector. Since the fix was authored by the upstream vendor (tatu.saloranta@iki.fi) and shipped in the upstream release, this is a not_affected case with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "The target repository is NOT vulnerable to CVE-2019-14893. The upstream fix (commit 998efd7082 by Tatu Saloranta) was already present in jackson-databind version 2.19.2 when TuxCare onboarded it. The fix adds org.apache.xalan.lib.sql.JNDIConnectionPool to the SubTypeValidator blocklist, preventing polymorphic deserialization of this JNDI gadget class. The blocklist is checked before object instantiation during bean deserialization, effectively blocking the attack vector. Since the fix was authored by the upstream vendor (tatu.saloranta@iki.fi) and shipped in the upstream release, this is a not_affected case with code_not_present justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:11:01.996232+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 (polymorphic typing issue with com.zaxxer.hikari.HikariDataSource) is not present in jackson-databind 2.19.2. The fix that blacklists HikariDataSource in SubTypeValidator was authored by upstream maintainer Tatu Saloranta (commit 73c1c2cc76) and was already included in the upstream 2.19.2 release before TuxCare's onboarding (commit 728babb449). The blacklist entry at line 107 of SubTypeValidator.java actively prevents deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 (polymorphic typing issue with com.zaxxer.hikari.HikariDataSource) is not present in jackson-databind 2.19.2. The fix that blacklists HikariDataSource in SubTypeValidator was authored by upstream maintainer Tatu Saloranta (commit 73c1c2cc76) and was already included in the upstream 2.19.2 release before TuxCare's onboarding (commit 728babb449). The blacklist entry at line 107 of SubTypeValidator.java actively prevents deserialization of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:14:37.389349+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.2-tuxcare.2 is not affected by CVE-2019-16942. The fix was already present in the upstream Jackson 2.19.2 release before TuxCare onboarded it. The vulnerable classes org.apache.commons.dbcp.datasources.PerUserPoolDataSource and org.apache.commons.dbcp.datasources.SharedPoolDataSource are in the deserialization blocklist at SubTypeValidator.java lines 124-125, preventing their instantiation during polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "Target version 2.19.2-tuxcare.2 is not affected by CVE-2019-16942. The fix was already present in the upstream Jackson 2.19.2 release before TuxCare onboarded it. The vulnerable classes org.apache.commons.dbcp.datasources.PerUserPoolDataSource and org.apache.commons.dbcp.datasources.SharedPoolDataSource are in the deserialization blocklist at SubTypeValidator.java lines 124-125, preventing their instantiation during polymorphic typing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:22:22.486046+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16943 is not present in jackson-databind 2.19.2-tuxcare.2. The upstream fix by Tatu Saloranta (commits 9593e16cf5 and 328a0f833d) was already included in the upstream 2.19.2 release that TuxCare onboarded. The fix adds three dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, and org.apache.commons.dbcp.datasources.SharedPoolDataSource) to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. When these classes are encountered during polymorphic type handling, SubTypeValidator.validateSubType() throws an error (\"Illegal type to deserialize: prevented for security reasons\"), blocking the attack chain from INPUT (JSON with polymorphic type metadata) to GOAL (arbitrary code execution via deserialization gadget).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "CVE-2019-16943 is not present in jackson-databind 2.19.2-tuxcare.2. The upstream fix by Tatu Saloranta (commits 9593e16cf5 and 328a0f833d) was already included in the upstream 2.19.2 release that TuxCare onboarded. The fix adds three dangerous gadget classes (com.p6spy.engine.spy.P6DataSource, org.apache.commons.dbcp.datasources.PerUserPoolDataSource, and org.apache.commons.dbcp.datasources.SharedPoolDataSource) to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist, preventing their deserialization. When these classes are encountered during polymorphic type handling, SubTypeValidator.validateSubType() throws an error (\"Illegal type to deserialize: prevented for security reasons\"), blocking the attack chain from INPUT (JSON with polymorphic type metadata) to GOAL (arbitrary code execution via deserialization gadget).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:31:44.936589+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability pattern is absent because the upstream vendor (FasterXML) already fixed it in jackson-databind 2.9.10 (commit 191a4cdf, September 2019), which predates the 2.19.2 release that TuxCare onboarded. The fix adds \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" to the SubTypeValidator blocklist, preventing polymorphic deserialization of this dangerous gadget class. This blocklist entry is present in the target at SubTypeValidator.java:99.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability pattern is absent because the upstream vendor (FasterXML) already fixed it in jackson-databind 2.9.10 (commit 191a4cdf, September 2019), which predates the 2.19.2 release that TuxCare onboarded. The fix adds \"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\" to the SubTypeValidator blocklist, preventing polymorphic deserialization of this dangerous gadget class. This blocklist entry is present in the target at SubTypeValidator.java:99.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:51:40.336684+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 addresses a polymorphic deserialization vulnerability in jackson-databind where attackers could achieve arbitrary code execution via JNDI injection by specifying log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) in JSON type metadata when Default Typing is enabled. The upstream fix (commit b5a304a985 by Tatu Saloranta, dated 2019-10-12) added these two classes to the deserialization denylist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.19.2 release before TuxCare onboarded it (first TuxCare commit 728babb44 \"Onboard version 2.19.2\"), making the target version not affected. The vulnerable pattern is not present because the upstream vendor fix was shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 addresses a polymorphic deserialization vulnerability in jackson-databind where attackers could achieve arbitrary code execution via JNDI injection by specifying log4j-extras classes (org.apache.log4j.receivers.db.DriverManagerConnectionSource and org.apache.log4j.receivers.db.JNDIConnectionSource) in JSON type metadata when Default Typing is enabled. The upstream fix (commit b5a304a985 by Tatu Saloranta, dated 2019-10-12) added these two classes to the deserialization denylist in SubTypeValidator.java. This fix was already included in the upstream jackson-databind 2.19.2 release before TuxCare onboarded it (first TuxCare commit 728babb44 \"Onboard version 2.19.2\"), making the target version not affected. The vulnerable pattern is not present because the upstream vendor fix was shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns missing blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector classes that could be exploited for remote code execution via JNDI injection during polymorphic deserialization. The target repository already contains the fix at lines 133-135 of SubTypeValidator.java, which blocks these classes from deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883 and was already present in the upstream 2.19.2 release when TuxCare onboarded it (commit 728babb449).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns missing blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector classes that could be exploited for remote code execution via JNDI injection during polymorphic deserialization. The target repository already contains the fix at lines 133-135 of SubTypeValidator.java, which blocks these classes from deserialization. This fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883 and was already present in the upstream 2.19.2 release when TuxCare onboarded it (commit 728babb449).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:41.975072+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.19.2-tuxcare.2 is NOT affected by CVE-2020-10650. The vulnerability involved missing blocklist entries for ignite-jta and quartz-core gadget classes that could enable arbitrary code execution through unsafe deserialization. The upstream vendor (FasterXML) fixed this vulnerability in March 2020 by adding three class names to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream version 2.19.2 when TuxCare onboarded it. CVE-2020-10650 affects versions \"before 2.9.10.4\", and the target is version 2.19.2 (released years later), which already contains the complete upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "The target jackson-databind version 2.19.2-tuxcare.2 is NOT affected by CVE-2020-10650. The vulnerability involved missing blocklist entries for ignite-jta and quartz-core gadget classes that could enable arbitrary code execution through unsafe deserialization. The upstream vendor (FasterXML) fixed this vulnerability in March 2020 by adding three class names to the deserialization blocklist in SubTypeValidator.java. This fix was already present in the upstream version 2.19.2 when TuxCare onboarded it. CVE-2020-10650 affects versions \"before 2.9.10.4\", and the target is version 2.19.2 (released years later), which already contains the complete upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind version 2.19.2-tuxcare.2 is NOT AFFECTED by CVE-2020-10672. The upstream fix that blocks deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. The SubTypeValidator blocklist (SubTypeValidator.java lines 162-164) contains both vulnerable class names, preventing the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "Target jackson-databind version 2.19.2-tuxcare.2 is NOT AFFECTED by CVE-2020-10672. The upstream fix that blocks deserialization of org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory and org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. The SubTypeValidator blocklist (SubTypeValidator.java lines 162-164) contains both vulnerable class names, preventing the deserialization gadget attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:36:34.248507+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10673 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involved the deserialization gadget class com.caucho.config.types.ResourceRef, which could enable arbitrary code execution through Jackson's polymorphic type handling. The upstream fix (commit 1645efbd39, authored by Tatu Saloranta on 2020-03-17) added this class to the deserialization blacklist in SubTypeValidator.java line 167. This fix shipped in the upstream release 2.19.2 and was already present when TuxCare onboarded the version. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "CVE-2020-10673 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involved the deserialization gadget class com.caucho.config.types.ResourceRef, which could enable arbitrary code execution through Jackson's polymorphic type handling. The upstream fix (commit 1645efbd39, authored by Tatu Saloranta on 2020-03-17) added this class to the deserialization blacklist in SubTypeValidator.java line 167. This fix shipped in the upstream release 2.19.2 and was already present when TuxCare onboarded the version. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10968 does not affect jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. The blocklist entries are at SubTypeValidator.java:169-171, added by upstream commit 05d7e0e13f (authored by Tatu Saloranta on 2020-03-25). This fix was included in jackson-databind 2.9.10.4 and all subsequent versions, well before the 2.19.2 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "CVE-2020-10968 does not affect jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization of the gadget class org.aoju.bus.proxy.provider.remoting.RmiProvider. The fix (adding this class to the SubTypeValidator blocklist) was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. The blocklist entries are at SubTypeValidator.java:169-171, added by upstream commit 05d7e0e13f (authored by Tatu Saloranta on 2020-03-25). This fix was included in jackson-databind 2.9.10.4 and all subsequent versions, well before the 2.19.2 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10969 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.19.2-tuxcare.2, which is significantly newer. The vulnerability involves allowing javax.swing.JEditorPane to be deserialized as part of polymorphic type handling, enabling gadget-chain exploitation. The upstream fix (adding JEditorPane to the deserialization blocklist in SubTypeValidator.java) was already present in upstream version 2.19.2 when TuxCare onboarded it. The fix is present at line 150 of SubTypeValidator.java. Since the vulnerable code pattern is not present (the fix shipped in the upstream release), the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "CVE-2020-10969 affects jackson-databind versions before 2.9.10.4. The target repository is version 2.19.2-tuxcare.2, which is significantly newer. The vulnerability involves allowing javax.swing.JEditorPane to be deserialized as part of polymorphic type handling, enabling gadget-chain exploitation. The upstream fix (adding JEditorPane to the deserialization blocklist in SubTypeValidator.java) was already present in upstream version 2.19.2 when TuxCare onboarded it. The fix is present at line 150 of SubTypeValidator.java. Since the vulnerable code pattern is not present (the fix shipped in the upstream release), the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.2-tuxcare.2 is NOT AFFECTED by CVE-2020-11111. The vulnerability concerns deserialization of org.apache.activemq.* gadget classes. The fix (blocklisting these classes in SubTypeValidator.java) was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. All nine activemq classes from the vendor patches are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 173-183, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "The target jackson-databind 2.19.2-tuxcare.2 is NOT AFFECTED by CVE-2020-11111. The vulnerability concerns deserialization of org.apache.activemq.* gadget classes. The fix (blocklisting these classes in SubTypeValidator.java) was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. All nine activemq classes from the vendor patches are present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at lines 173-183, preventing their deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider, which could lead to arbitrary code execution. The upstream vendor (Tatu Saloranta) fixed this in commit 05d7e0e13f by adding the dangerous class to the SubTypeValidator blocklist. This fix was already present in upstream release 2.19.2, which TuxCare onboarded without modification. The target version contains the complete defense: SubTypeValidator.java line 186 blocks the RmiProvider class, and the validateSubType() method (lines 269-303) enforces the blocklist, rejecting any attempt to deserialize the dangerous class with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns unsafe deserialization of org.apache.commons.proxy.provider.remoting.RmiProvider, which could lead to arbitrary code execution. The upstream vendor (Tatu Saloranta) fixed this in commit 05d7e0e13f by adding the dangerous class to the SubTypeValidator blocklist. This fix was already present in upstream release 2.19.2, which TuxCare onboarded without modification. The target version contains the complete defense: SubTypeValidator.java line 186 blocks the RmiProvider class, and the validateSubType() method (lines 269-303) enforces the blocklist, rejecting any attempt to deserialize the dangerous class with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.19.2-tuxcare.2 is not affected by CVE-2020-11113. The vulnerability involves polymorphic deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime, which could lead to arbitrary code execution. However, the upstream fix (blocklist entry for this class) was already present in the upstream release 2.9.10.4 (March 2020) and is included in version 2.19.2. The fix is present at line 84 of SubTypeValidator.java, added by upstream author Tatu Saloranta, and was shipped in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target jackson-databind 2.19.2-tuxcare.2 is not affected by CVE-2020-11113. The vulnerability involves polymorphic deserialization of org.apache.openjpa.ee.WASRegistryManagedRuntime, which could lead to arbitrary code execution. However, the upstream fix (blocklist entry for this class) was already present in the upstream release 2.9.10.4 (March 2020) and is included in version 2.19.2. The fix is present at line 84 of SubTypeValidator.java, added by upstream author Tatu Saloranta, and was shipped in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for dangerous Spring Framework classes (MethodLocatingFactoryBean, BeanReferenceFactoryBean) that can be exploited as serialization gadgets during polymorphic deserialization. The target repository (jackson-databind 2.19.2-tuxcare.2) contains the upstream fix from commit 113e89fb08b (April 6, 2020, authored by Tatu Saloranta), which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.2 release before TuxCare's onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 affects jackson-databind versions before 2.9.10.4 due to missing blocklist entries for dangerous Spring Framework classes (MethodLocatingFactoryBean, BeanReferenceFactoryBean) that can be exploited as serialization gadgets during polymorphic deserialization. The target repository (jackson-databind 2.19.2-tuxcare.2) contains the upstream fix from commit 113e89fb08b (April 6, 2020, authored by Tatu Saloranta), which adds these two classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream 2.19.2 release before TuxCare's onboarding, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.19.2-tuxcare.2) is not affected by CVE-2020-11620. The vulnerability relates to missing blocklist protection for the org.apache.commons.jelly.impl.Embedded gadget class in jackson-databind's polymorphic deserialization. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already present in the upstream release 2.19.2, authored by Tatu Saloranta (FasterXML maintainer) on April 7, 2020. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "The target repository (jackson-databind 2.19.2-tuxcare.2) is not affected by CVE-2020-11620. The vulnerability relates to missing blocklist protection for the org.apache.commons.jelly.impl.Embedded gadget class in jackson-databind's polymorphic deserialization. The fix (adding this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java) was already present in the upstream release 2.19.2, authored by Tatu Saloranta (FasterXML maintainer) on April 7, 2020. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:21:54.536967+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 is not present in jackson-databind 2.19.2. The vulnerability was fixed upstream by adding the gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" to the denylist in SubTypeValidator.java. This fix was included in the upstream release 2.19.2 (commit d1c67a0396e from April 2020) before TuxCare onboarded this version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 is not present in jackson-databind 2.19.2. The vulnerability was fixed upstream by adding the gadget class \"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\" to the denylist in SubTypeValidator.java. This fix was included in the upstream release 2.19.2 (commit d1c67a0396e from April 2020) before TuxCare onboarded this version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 affects jackson-databind 2.x before 2.9.10.5, relating to Oracle JMS deserialization gadgets. The target version 2.19.2 already contains the upstream fix that blocks these classes. The fix (commit 5c8642ae) was authored by upstream maintainer Tatu Saloranta and was present in the upstream release 2.19.2 when TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 affects jackson-databind 2.x before 2.9.10.5, relating to Oracle JMS deserialization gadgets. The target version 2.19.2 already contains the upstream fix that blocks these classes. The fix (commit 5c8642ae) was authored by upstream maintainer Tatu Saloranta and was present in the upstream release 2.19.2 when TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:23:21.346897+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization gadgets using com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to achieve remote code execution via JNDI lookups. The fix (adding this class to the SubTypeValidator deny-list) was already present in the upstream 2.19.2 release that TuxCare onboarded. The dangerous class is blocked at line 119 of SubTypeValidator.java, and the validation is properly integrated into the deserialization path via BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization gadgets using com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool to achieve remote code execution via JNDI lookups. The fix (adding this class to the SubTypeValidator deny-list) was already present in the upstream 2.19.2 release that TuxCare onboarded. The dangerous class is blocked at line 119 of SubTypeValidator.java, and the validation is properly integrated into the deserialization path via BeanDeserializerFactory and DatabindContext.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 is not present in jackson-databind 2.19.2. The vulnerability involves Jackson's polymorphic deserialization mishandling of org.jsecurity.realm.jndi.JndiRealmFactory, which could allow remote code execution via JNDI injection. The upstream fix adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 207). This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.19.2 release that TuxCare onboarded. The target is not affected because the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 is not present in jackson-databind 2.19.2. The vulnerability involves Jackson's polymorphic deserialization mishandling of org.jsecurity.realm.jndi.JndiRealmFactory, which could allow remote code execution via JNDI injection. The upstream fix adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 207). This fix was authored by upstream maintainer Tatu Saloranta and was already included in the upstream 2.19.2 release that TuxCare onboarded. The target is not affected because the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:23:14.032161+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource, which is blocked in SubTypeValidator.java at line 147. This fix was introduced by upstream FasterXML in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 and was already present in the upstream 2.19.2 release that TuxCare onboarded. The CVE affects versions before 2.9.10.6, while 2.19.2 is significantly newer and includes the fix. The SubTypeValidator defense is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves deserialization of the gadget class br.com.anteros.dbcp.AnterosDBCPDataSource, which is blocked in SubTypeValidator.java at line 147. This fix was introduced by upstream FasterXML in commit 3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7 and was already present in the upstream 2.19.2 release that TuxCare onboarded. The CVE affects versions before 2.9.10.6, while 2.19.2 is significantly newer and includes the fix. The SubTypeValidator defense is actively enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:18:37.633690+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.19.2-tuxcare.2 is NOT vulnerable to CVE-2020-24750. The fix for this vulnerability (blacklisting com.pastdev.httpcomponents.configuration.JndiConfiguration) was included in the upstream Jackson release and is present in the target at SubTypeValidator.java:210. The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.19.2 release that TuxCare later onboarded. The vulnerable deserialization gadget is blocked by the existing blacklist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "The target repository jackson-databind version 2.19.2-tuxcare.2 is NOT vulnerable to CVE-2020-24750. The fix for this vulnerability (blacklisting com.pastdev.httpcomponents.configuration.JndiConfiguration) was included in the upstream Jackson release and is present in the target at SubTypeValidator.java:210. The fix was authored by the upstream maintainer (tatu.saloranta@iki.fi) and shipped in the upstream 2.19.2 release that TuxCare later onboarded. The vulnerable deserialization gadget is blocked by the existing blacklist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.19.2. The fix was shipped in the upstream 2.19.2 release authored by Tatu Saloranta (upstream maintainer) in January 2020. The target code at DOMDeserializer.java:39-45 contains the required XML security features: disallow-doctype-decl=true and load-external-dtd=false, which block DOCTYPE declarations and external DTD loading to prevent XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) is not present in jackson-databind 2.19.2. The fix was shipped in the upstream 2.19.2 release authored by Tatu Saloranta (upstream maintainer) in January 2020. The target code at DOMDeserializer.java:39-45 contains the required XML security features: disallow-doctype-decl=true and load-external-dtd=false, which block DOCTYPE declarations and external DTD loading to prevent XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:23:41.009963+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.19.2-tuxcare.2) already contains the upstream fix that blocks these gadget classes. The fix was introduced in upstream commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by Tatu Saloranta and was already present in the 2.19.2 release when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "CVE-2020-35490 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource. The target repository (jackson-databind 2.19.2-tuxcare.2) already contains the upstream fix that blocks these gadget classes. The fix was introduced in upstream commit 41b8bdb5ccc1d8edb71acf1c8234da235a24249d by Tatu Saloranta and was already present in the 2.19.2 release when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:54:30.943101+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.19.2-tuxcare.1 is NOT AFFECTED by CVE-2020-35491. The vulnerability (missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) was fixed by the upstream vendor (FasterXML) in commit 41b8bdb5ccc (December 2020) and was already included in the upstream 2.19.2 release that TuxCare onboarded. The fix is present in SubTypeValidator.java lines 217-218, blocking deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "The target jackson-databind version 2.19.2-tuxcare.1 is NOT AFFECTED by CVE-2020-35491. The vulnerability (missing blocklist entries for org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource) was fixed by the upstream vendor (FasterXML) in commit 41b8bdb5ccc (December 2020) and was already included in the upstream 2.19.2 release that TuxCare onboarded. The fix is present in SubTypeValidator.java lines 217-218, blocking deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:56:12.360360+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35728 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerable gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool' is blacklisted in SubTypeValidator.java (line 240). This fix was included in the upstream 2.19.2 release by Tatu Saloranta and predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "CVE-2020-35728 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerable gadget class 'com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool' is blacklisted in SubTypeValidator.java (line 240). This fix was included in the upstream 2.19.2 release by Tatu Saloranta and predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:26:57.486633+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.2-tuxcare.2 is NOT AFFECTED by CVE-2020-36179. The vulnerability is absent because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in upstream release 2.19.2 before TuxCare onboarded it. The fix adds five DriverAdapterCPDS class name variants to SubTypeValidator's deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their use as polymorphic deserialization gadgets. All five entries are present in the target code at SubTypeValidator.java lines 123, 193, 219, 228, and 234. When Jackson attempts to deserialize JSON with type metadata naming any of these classes, validateSubType() (line 269) detects the match and throws \"Illegal type to deserialize: prevented for security reasons\" (line 302-303), blocking the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "Target jackson-databind 2.19.2-tuxcare.2 is NOT AFFECTED by CVE-2020-36179. The vulnerability is absent because the upstream fix (commit 3ded28aece by Tatu Saloranta) was already present in upstream release 2.19.2 before TuxCare onboarded it. The fix adds five DriverAdapterCPDS class name variants to SubTypeValidator's deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES), preventing their use as polymorphic deserialization gadgets. All five entries are present in the target code at SubTypeValidator.java lines 123, 193, 219, 228, and 234. When Jackson attempts to deserialize JSON with type metadata naming any of these classes, validateSubType() (line 269) detects the match and throws \"Illegal type to deserialize: prevented for security reasons\" (line 302-303), blocking the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:43:48.993875+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.2-tuxcare.2 is not affected by CVE-2020-36180. The vulnerability involves deserialization of gadget classes (org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes) that can enable RCE chains. The upstream fix added these classes to a deny-list in SubTypeValidator.java and was released in jackson-databind 2.9.10.8 on Dec 31, 2020 (commit 3ded28aece69). Since the target version 2.19.2 is significantly newer than 2.9.10.8, the fix was already present when 2.19.2 was released upstream. All five DriverAdapterCPDS variants from the patch are confirmed present in the target's deny-list (lines 123, 193, 219, 228, 234 of SubTypeValidator.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "Target jackson-databind 2.19.2-tuxcare.2 is not affected by CVE-2020-36180. The vulnerability involves deserialization of gadget classes (org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS and related DBCP classes) that can enable RCE chains. The upstream fix added these classes to a deny-list in SubTypeValidator.java and was released in jackson-databind 2.9.10.8 on Dec 31, 2020 (commit 3ded28aece69). Since the target version 2.19.2 is significantly newer than 2.9.10.8, the fix was already present when 2.19.2 was released upstream. All five DriverAdapterCPDS variants from the patch are confirmed present in the target's deny-list (lines 123, 193, 219, 228, 234 of SubTypeValidator.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:47:24.883937+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The fix (blocklist entry) was already present in upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta, which shipped in the upstream release before TuxCare onboarded version 2.19.2. The blocklist entry at SubTypeValidator.java:228 prevents deserialization of the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability concerns deserialization gadgets related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. The fix (blocklist entry) was already present in upstream commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta, which shipped in the upstream release before TuxCare onboarded version 2.19.2. The blocklist entry at SubTypeValidator.java:228 prevents deserialization of the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:14:08.658611+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 affects jackson-databind versions before 2.9.10.8, involving deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository version 2.19.2 already contains the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta dated Dec 31, 2020) which blacklists this class in SubTypeValidator.java. The fix was shipped in the upstream 2.19.2 release before TuxCare onboarded it, making this an upstream-provided protection rather than a TuxCare backport. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 affects jackson-databind versions before 2.9.10.8, involving deserialization of the gadget class org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository version 2.19.2 already contains the upstream fix (commit 3ded28aece694d0df39c9f0fa1ff385b14a8656b by Tatu Saloranta dated Dec 31, 2020) which blacklists this class in SubTypeValidator.java. The fix was shipped in the upstream 2.19.2 release before TuxCare onboarded it, making this an upstream-provided protection rather than a TuxCare backport. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:23:22.459243+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 does not affect jackson-databind 2.19.2-tuxcare.2. The vulnerability involves JNDI injection through deserialization of org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix (blocking this class via denylist) was already present in the upstream release 2.19.2 before TuxCare onboarded it. The dangerous class is in DEFAULT_NO_DESER_CLASS_NAMES at SubTypeValidator.java:243, and validateSubType() enforces the block at line 269. Fix authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 12e23c962ff, which is an ancestor of the first TuxCare onboarding commit 728babb449.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 does not affect jackson-databind 2.19.2-tuxcare.2. The vulnerability involves JNDI injection through deserialization of org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. The fix (blocking this class via denylist) was already present in the upstream release 2.19.2 before TuxCare onboarded it. The dangerous class is in DEFAULT_NO_DESER_CLASS_NAMES at SubTypeValidator.java:243, and validateSubType() enforces the block at line 269. Fix authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 12e23c962ff, which is an ancestor of the first TuxCare onboarding commit 728babb449.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:21.485909+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36184 is NOT present in jackson-databind 2.19.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The upstream vendor (Tatu Saloranta) fixed this in commit 567194c53ae91f0a14dc27239afb739b1c10448a by adding PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream release 2.19.2 that TuxCare onboarded (commit 728babb449), making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "CVE-2020-36184 is NOT present in jackson-databind 2.19.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources classes. The upstream vendor (Tatu Saloranta) fixed this in commit 567194c53ae91f0a14dc27239afb739b1c10448a by adding PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This fix was already included in the upstream release 2.19.2 that TuxCare onboarded (commit 728babb449), making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:10:12.627525+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is not present in jackson-databind version 2.19.2-tuxcare.2. The vulnerability concerns missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource classes, which are deserialization gadgets that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the SubTypeValidator blocklist and was already included in the upstream 2.19.2 release before TuxCare onboarded it. The target repository contains the fix at SubTypeValidator.java lines 232-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is not present in jackson-databind version 2.19.2-tuxcare.2. The vulnerability concerns missing blocklist entries for org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource classes, which are deserialization gadgets that could enable arbitrary code execution. The upstream fix (commit 567194c53a by Tatu Saloranta) added these classes to the SubTypeValidator blocklist and was already included in the upstream 2.19.2 release before TuxCare onboarded it. The target repository contains the fix at SubTypeValidator.java lines 232-236.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:39:42.552241+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.19.2-tuxcare.2 is not affected by CVE-2020-36186. The vulnerability concerns unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource classes, which could enable JNDI injection and arbitrary code execution. The upstream fix (commit 3e8fa3beea by Tatu Saloranta) added these classes to the deserialization blacklist in SubTypeValidator.java lines 229-230. This fix was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded, appearing 3607 commits before TuxCare's first onboarding commit (728babb449).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "Target jackson-databind 2.19.2-tuxcare.2 is not affected by CVE-2020-36186. The vulnerability concerns unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource classes, which could enable JNDI injection and arbitrary code execution. The upstream fix (commit 3e8fa3beea by Tatu Saloranta) added these classes to the deserialization blacklist in SubTypeValidator.java lines 229-230. This fix was already present in the upstream jackson-databind 2.19.2 release that TuxCare onboarded, appearing 3607 commits before TuxCare's first onboarding commit (728babb449).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:50:46.310411+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The target version 2.19.2-tuxcare.2 is NOT vulnerable because the upstream vendor (FasterXML) already fixed this vulnerability in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (Dec 26, 2020) by adding SharedPoolDataSource to the deserialization blacklist. This fix was included in the upstream release 2.19.2 that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "CVE-2020-36187 affects jackson-databind versions before 2.9.10.8 due to unsafe deserialization of org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. The target version 2.19.2-tuxcare.2 is NOT vulnerable because the upstream vendor (FasterXML) already fixed this vulnerability in commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (Dec 26, 2020) by adding SharedPoolDataSource to the deserialization blacklist. This fix was included in the upstream release 2.19.2 that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:58:22.317135+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36188 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves jackson-databind's polymorphic deserialization allowing attackers to specify malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) to achieve arbitrary code execution. The upstream fix was committed by Tatu Saloranta on 2020-12-26 and first shipped in version 2.9.10.8. The target version 2.19.2 is much newer and already contains this upstream fix. The blocklist entries are present in SubTypeValidator.java lines 223-224, preventing deserialization of the gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "CVE-2020-36188 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves jackson-databind's polymorphic deserialization allowing attackers to specify malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) to achieve arbitrary code execution. The upstream fix was committed by Tatu Saloranta on 2020-12-26 and first shipped in version 2.9.10.8. The target version 2.19.2 is much newer and already contains this upstream fix. The blocklist entries are present in SubTypeValidator.java lines 223-224, preventing deserialization of the gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:09:44.726673+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 affects jackson-databind 2.x before 2.9.10.8, which mishandles deserialization of specific gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.*). The target version 2.19.2 is significantly newer and already contains the upstream fix from commit 33d96c13 (Dec 2020) that adds these classes to the SubTypeValidator blocklist. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.2 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 affects jackson-databind 2.x before 2.9.10.8, which mishandles deserialization of specific gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.*). The target version 2.19.2 is significantly newer and already contains the upstream fix from commit 33d96c13 (Dec 2020) that adds these classes to the SubTypeValidator blocklist. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.19.2 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:18:54.750507+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.19.2. The vulnerability was fixed in upstream releases 2.13.2 (March 2022) and 2.12.7 (May 2022) through two commits: (1) fcfc4998ec which added MAX_DEPTH=1000 limit to prevent stack overflow from deeply nested JSON, and (2) 8238ab41d0 which re-implemented UntypedObjectDeserializer using a non-recursive iterative approach with UntypedObjectDeserializerNR. Both fixes were shipped in the upstream release that TuxCare onboarded as version 2.19.2, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.19.2. The vulnerability was fixed in upstream releases 2.13.2 (March 2022) and 2.12.7 (May 2022) through two commits: (1) fcfc4998ec which added MAX_DEPTH=1000 limit to prevent stack overflow from deeply nested JSON, and (2) 8238ab41d0 which re-implemented UntypedObjectDeserializer using a non-recursive iterative approach with UntypedObjectDeserializerNR. Both fixes were shipped in the upstream release that TuxCare onboarded as version 2.19.2, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:17:47.656427+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-8840 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerable pattern (missing blocklist entry for org.apache.xbean.propertyeditor.JndiConverter) was fixed in upstream commit 914e7c9f2c by Tatu Saloranta. This fix shipped in the upstream 2.19.2 release that TuxCare onboarded, before any TuxCare modifications. The class is present in DEFAULT_NO_DESER_CLASS_NAMES at SubTypeValidator.java:138, preventing deserialization attacks via this JNDI gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "CVE-2020-8840 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerable pattern (missing blocklist entry for org.apache.xbean.propertyeditor.JndiConverter) was fixed in upstream commit 914e7c9f2c by Tatu Saloranta. This fix shipped in the upstream 2.19.2 release that TuxCare onboarded, before any TuxCare modifications. The class is present in DEFAULT_NO_DESER_CLASS_NAMES at SubTypeValidator.java:138, preventing deserialization attacks via this JNDI gadget.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:20:30.171913+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9546 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability requires the absence of a blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig in SubTypeValidator. The target contains the fix at SubTypeValidator.java:141, added by upstream commit 1e64db6a2f authored by tatu.saloranta@iki.fi. This fix was already present in upstream release 2.19.2 before TuxCare onboarding (first TuxCare commit 728babb4). The defense blocks deserialization of the gadget class by checking against DEFAULT_NO_DESER_CLASS_NAMES and throwing JsonMappingException when matched, preventing arbitrary object instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "CVE-2020-9546 is NOT present in jackson-databind 2.19.2-tuxcare.2. The vulnerability requires the absence of a blocklist entry for org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig in SubTypeValidator. The target contains the fix at SubTypeValidator.java:141, added by upstream commit 1e64db6a2f authored by tatu.saloranta@iki.fi. This fix was already present in upstream release 2.19.2 before TuxCare onboarding (first TuxCare commit 728babb4). The defense blocks deserialization of the gadget class by checking against DEFAULT_NO_DESER_CLASS_NAMES and throwing JsonMappingException when matched, preventing arbitrary object instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:47:06.064229+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.19.2-tuxcare.2 is not affected by CVE-2020-9547. The vulnerability was fixed in upstream release 2.19.2 (before TuxCare onboarding) by adding `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` to the deserialization blocklist in SubTypeValidator.java. The fix commit (1e64db6a2f) was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.19.2. The vulnerable pattern (ability to deserialize the malicious gadget class) is not present because the blocklist entry prevents instantiation of this type during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "The target jackson-databind version 2.19.2-tuxcare.2 is not affected by CVE-2020-9547. The vulnerability was fixed in upstream release 2.19.2 (before TuxCare onboarding) by adding `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` to the deserialization blocklist in SubTypeValidator.java. The fix commit (1e64db6a2f) was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.19.2. The vulnerable pattern (ability to deserialize the malicious gadget class) is not present because the blocklist entry prevents instantiation of this type during polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:21:06.039557+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9548 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves failure to block deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The fix (adding this class to SubTypeValidator's deny-list) was applied by upstream FasterXML maintainer Tatu Saloranta in commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb on Feb 29, 2020. This fix was already present in the upstream jackson-databind 2.19.2 release when TuxCare onboarded it. The target version (2.19.2) is far beyond the CVE's affected range (before 2.9.10.4, 2.8.11.6, 2.7.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "CVE-2020-9548 is not present in jackson-databind 2.19.2-tuxcare.2. The vulnerability involves failure to block deserialization of the br.com.anteros.dbcp.AnterosDBCPConfig gadget class. The fix (adding this class to SubTypeValidator's deny-list) was applied by upstream FasterXML maintainer Tatu Saloranta in commit 1e64db6a2fad331f96c7363fda3bc5f3dffa25bb on Feb 29, 2020. This fix was already present in the upstream jackson-databind 2.19.2 release when TuxCare onboarded it. The target version (2.19.2) is far beyond the CVE's affected range (before 2.9.10.4, 2.8.11.6, 2.7.9.7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:17:47.351003+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is NOT present in jackson-databind 2.19.2. The vulnerability required blocking the deserialization gadget class javax.swing.JTextPane. The fix (commit 7dbf51bf78) was authored by upstream maintainer Tatu Saloranta and was included in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. The gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:151 and is actively enforced during deserialization at line 269, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is NOT present in jackson-databind 2.19.2. The vulnerability required blocking the deserialization gadget class javax.swing.JTextPane. The fix (commit 7dbf51bf78) was authored by upstream maintainer Tatu Saloranta and was included in the upstream jackson-databind 2.19.2 release that TuxCare onboarded. The gadget class is present in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:151 and is actively enforced during deserialization at line 269, preventing exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 affects jackson-databind through unprotected memory allocation in NodeSerialization.readExternal(), allowing DoS via maliciously large length fields in JDK-serialized data. The target (jackson-databind 2.19.2-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 3ccde7d938) was already present in version 2.19.2 when TuxCare onboarded it. The fix limits upfront allocation to 100KB and uses incremental ByteArrayBuilder-based allocation for larger declared lengths, preventing the 2GB heap exhaustion attack. The vulnerable pattern (direct byte[len] allocation without bounds checking) is absent from the target's NodeSerialization.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 affects jackson-databind through unprotected memory allocation in NodeSerialization.readExternal(), allowing DoS via maliciously large length fields in JDK-serialized data. The target (jackson-databind 2.19.2-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 3ccde7d938) was already present in version 2.19.2 when TuxCare onboarded it. The fix limits upfront allocation to 100KB and uses incremental ByteArrayBuilder-based allocation for larger declared lengths, preventing the 2GB heap exhaustion attack. The vulnerable pattern (direct byte[len] allocation without bounds checking) is absent from the target's NodeSerialization.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:50:26.784780+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.2 is NOT AFFECTED. The upstream fix for CVE-2022-42003 was already present in the upstream 2.19.2 release that TuxCare onboarded. The fix adds nested array depth checks in primitive deserializers (StdDeserializer) and BeanDeserializer to prevent resource exhaustion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. Fix commits d78d00ee7b and cd090979b7 are ancestors of HEAD and predate the TuxCare onboard commit (728babb449), confirming this is an upstream vendor fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "Target version 2.19.2 is NOT AFFECTED. The upstream fix for CVE-2022-42003 was already present in the upstream 2.19.2 release that TuxCare onboarded. The fix adds nested array depth checks in primitive deserializers (StdDeserializer) and BeanDeserializer to prevent resource exhaustion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled. Fix commits d78d00ee7b and cd090979b7 are ancestors of HEAD and predate the TuxCare onboard commit (728babb449), confirming this is an upstream vendor fix shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:03:12.180165+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Target version 2.19.2-tuxcare.2 is not affected by CVE-2022-42004. The vulnerability (unbounded nested array recursion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream jackson-databind 2.13.4 and is not present in 2.19.2. The fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by upstream maintainer Tatu Saloranta) was already included in the upstream 2.19.2 release before TuxCare onboarded it, as confirmed by the nested array check at BeanDeserializer.java:653-661.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "Target version 2.19.2-tuxcare.2 is not affected by CVE-2022-42004. The vulnerability (unbounded nested array recursion when UNWRAP_SINGLE_VALUE_ARRAYS is enabled) was fixed in upstream jackson-databind 2.13.4 and is not present in 2.19.2. The fix (commit 063183589218fec19a9293ed2f17ec53ea80ba88 by upstream maintainer Tatu Saloranta) was already included in the upstream 2.19.2 release before TuxCare onboarded it, as confirmed by the nested array check at BeanDeserializer.java:653-661.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T20:23:31.994912+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 does not affect jackson-databind 2.19.2-tuxcare.2. The vulnerability (DoS via stack overflow when serializing deeply nested JSON using JsonNode.toString()) was fixed in upstream version 2.14.0. The target version 2.19.2 already includes the upstream fix (commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by tatu.saloranta@iki.fi), which converts recursive JsonNode serialization to i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 does not affect jackson-databind 2.19.2-tuxcare.2. The vulnerability (DoS via stack overflow when serializing deeply nested JSON using JsonNode.toString()) was fixed in upstream version 2.14.0. The target version 2.19.2 already includes the upstream fix (commit a1fa4ae4ecf5cee16da465985f135f3e81816f8c by tatu.saloranta@iki.fi), which converts recursive JsonNode serialization to i..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:35:00.132074+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "action_statement": "Vulnerability CVE-2026-54518 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59888"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:35:49.364761+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:35:00.132074+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:35:49.364761+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:35:49.364761+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.19.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T12:34:28.602043+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.19.2-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}