{ "@id": "urn:uuid:01427eb1-fbb5-4f3c-ba11-a4f091dbddd6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T07:56:13.824113+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2017-15095 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-15095" }, "action_statement": "Vulnerability CVE-2017-15095 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2017-17485 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-17485" }, "action_statement": "Vulnerability CVE-2017-17485 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2017-7525 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-7525" }, "action_statement": "Vulnerability CVE-2017-7525 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2018-11307 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-12022 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12022" }, "action_statement": "Vulnerability CVE-2018-12022 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-12023 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12023" }, "action_statement": "Vulnerability CVE-2018-12023 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-14718 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14718" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-14719 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14719" }, "action_statement": "Vulnerability CVE-2018-14719 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:13.824113+00:00", "status_notes": "Vulnerability CVE-2018-14720 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14720" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-14721 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14721" }, "action_statement": "Vulnerability CVE-2018-14721 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-19362 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2018-5968 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-5968" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2018-7489 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2019-12086 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2019-12384 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2019-12814 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-14540 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" }, "action_statement": "Vulnerability CVE-2019-14540 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-14893 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" }, "action_statement": "Vulnerability CVE-2019-14893 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2019-16335 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-17267 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-25649 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" }, "action_statement": "Vulnerability CVE-2020-25649 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-36180 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-36188 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-9546 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:56:00.063937+00:00", "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Version 2.2.3 is NOT affected by CVE-2022-42003. The vulnerability requires the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature, which was introduced in January 2014 (commit 0e37a395), approximately 5 months after version 2.2.3 was released (August 2013). The feature does not exist in the DeserializationFeature enum, and the primitive deserializers lack any array-handling code paths that could lead to deep recursion. The vulnerable code pattern is completely absent from this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42003" }, "impact_statement": "Version 2.2.3 is NOT affected by CVE-2022-42003. The vulnerability requires the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature, which was introduced in January 2014 (commit 0e37a395), approximately 5 months after version 2.2.3 was released (August 2013). The feature does not exist in the DeserializationFeature enum, and the primitive deserializers lack any array-handling code paths that could lead to deep recursion. The vulnerable code pattern is completely absent from this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. jackson-databind version 2.2.3 is NOT affected by CVE-2022-42004. The vulnerability requires the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature, which was introduced in version 2.4 and does not exist in version 2.2.3. The feature and the guarded unwrap branch are absent from this version; _deserializeFromArray does not exist here in any form. The target can receive JSON with nested arrays, but no execution path exists from that input to resource exhaustion because the array-unwrapping behavior is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-42004" }, "impact_statement": "jackson-databind version 2.2.3 is NOT affected by CVE-2022-42004. The vulnerability requires the UNWRAP_SINGLE_VALUE_ARRAYS deserialization feature, which was introduced in version 2.4 and does not exist in version 2.2.3. The feature and the guarded unwrap branch are absent from this version; _deserializeFromArray does not exist here in any form. The target can receive JSON with nested arrays, but no execution path exists from that input to resource exhaustion because the array-unwrapping behavior is absent." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-19032 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind 2.2.3 does not have java.nio.file.Path deserialization support. The vulnerable NioPathDeserializer class and all related code for handling Path-typed fields from JSON is absent. The CVE describes a vulnerability in NioPathDeserializer.deserialize() where untrusted JSON drives FileSystemProvider resolution via ServiceLoader. This entire feature does not exist in version 2.2.3, w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-19032" }, "impact_statement": "not_affected \u2014 jackson-databind 2.2.3 does not have java.nio.file.Path deserialization support. The vulnerable NioPathDeserializer class and all related code for handling Path-typed fields from JSON is absent. The CVE describes a vulnerability in NioPathDeserializer.deserialize() where untrusted JSON drives FileSystemProvider resolution via ServiceLoader. This entire feature does not exist in version 2.2.3, w..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Version 2.2.3 is not affected by CVE-2026-54512. This vulnerability describes a bypass of PolymorphicTypeValidator (PTV) where generic type parameters are not validated, allowing attackers to smuggle disallowed classes inside allowed containers. PTV was introduced in jackson-databind 2.10.0, and the CVE explicitly states the affected range is \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\". Version 2.2.3 (from 2013) predates PTV entirely - the component, the DatabindContext._resolveAndValidateGeneric() method, and the vulnerable code pattern do not exist in this version. While version 2.2.3 has no validation mechanism for polymorphic deserialization, the absence of PTV means the specific bypass vulnerability described in this CVE is not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.2.3 is not affected by CVE-2026-54512. This vulnerability describes a bypass of PolymorphicTypeValidator (PTV) where generic type parameters are not validated, allowing attackers to smuggle disallowed classes inside allowed containers. PTV was introduced in jackson-databind 2.10.0, and the CVE explicitly states the affected range is \"From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\". Version 2.2.3 (from 2013) predates PTV entirely - the component, the DatabindContext._resolveAndValidateGeneric() method, and the vulnerable code pattern do not exist in this version. While version 2.2.3 has no validation mechanism for polymorphic deserialization, the absence of PTV means the specific bypass vulnerability described in this CVE is not applicable." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54514 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind version 2.2.3 is NOT AFFECTED by CVE-2026-54514. The vulnerability concerns InetSocketAddress deserialization performing eager DNS resolution via `new InetSocketAddress(host, port)`. However, version 2.2.3 does not contain InetSocketAddress deserialization support at all\u2014this feature was added much later, first appearing in version 2.6.0-rc3b. An exhaustive search of the codeba...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54514" }, "impact_statement": "not_affected \u2014 jackson-databind version 2.2.3 is NOT AFFECTED by CVE-2026-54514. The vulnerability concerns InetSocketAddress deserialization performing eager DNS resolution via `new InetSocketAddress(host, port)`. However, version 2.2.3 does not contain InetSocketAddress deserialization support at all\u2014this feature was added much later, first appearing in version 2.6.0-rc3b. An exhaustive search of the codeba..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54515 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind version 2.2.3 is NOT affected by CVE-2026-54515. The vulnerability requires the ACCEPT_CASE_INSENSITIVE_PROPERTIES feature which was introduced after version 2.2.3. The vulnerable code pattern in BeanDeserializerBase.createContextual() that incorrectly rebuilds the property map from the unfiltered source (instead of the filtered contextual map) does not exist in this version. W...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54515" }, "impact_statement": "not_affected \u2014 jackson-databind version 2.2.3 is NOT affected by CVE-2026-54515. The vulnerability requires the ACCEPT_CASE_INSENSITIVE_PROPERTIES feature which was introduced after version 2.2.3. The vulnerable code pattern in BeanDeserializerBase.createContextual() that incorrectly rebuilds the property map from the unfiltered source (instead of the filtered contextual map) does not exist in this version. W..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.2.3 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped on creator parameters, a feature that was implemented in jackson-databind via issue #1467 in November 2024 (commit 502fe888da). Version 2.2.3 (released August 2013) predates this feature by over 11 years. The vulnerable method processUnwrappedCreatorProperties() does not exist in 2.2.3. The ta...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Version 2.2.3 is not affected by CVE-2026-54518. The vulnerability requires support for @JsonUnwrapped on creator parameters, a feature that was implemented in jackson-databind via issue #1467 in November 2024 (commit 502fe888da). Version 2.2.3 (released August 2013) predates this feature by over 11 years. The vulnerable method processUnwrappedCreatorProperties() does not exist in 2.2.3. The ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.2.3 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records, which were introduced in Java 14 (2020), seven years after jackson-databind 2.2.3 (2013). For regular POJOs in 2.2.3, @JsonIgnore properties are removed from the property map before PropertyNamingStrategy renaming occurs, preventing the vulnerability chain. No Record support code exists in this versi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Version 2.2.3 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records, which were introduced in Java 14 (2020), seven years after jackson-databind 2.2.3 (2013). For regular POJOs in 2.2.3, @JsonIgnore properties are removed from the property map before PropertyNamingStrategy renaming occurs, preventing the vulnerability chain. No Record support code exists in this versi..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability CVE-2026-91777 does not affect version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Version 2.2.3 is not affected by CVE-2026-91777. The vulnerable code pattern (linear search in CollectionReferringAccumulator.resolveForwardReference) does not exist in this version. Forward reference resolution for collections and maps was introduced in version 2.4.0-rc1 (commit 24cbdbdfc, December 2013), after version 2.2.3 was released. When encountering unresolved Object IDs, version 2.2.3 throws an IllegalStateException rather than queueing and resolving them. CollectionDeserializer and MapDeserializer in version 2.2.3 do not support @JsonIdentityInfo forward references at all.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-91777" }, "impact_statement": "Version 2.2.3 is not affected by CVE-2026-91777. The vulnerable code pattern (linear search in CollectionReferringAccumulator.resolveForwardReference) does not exist in this version. Forward reference resolution for collections and maps was introduced in version 2.4.0-rc1 (commit 24cbdbdfc, December 2013), after version 2.2.3 was released. When encountering unresolved Object IDs, version 2.2.3 throws an IllegalStateException rather than queueing and resolving them. CollectionDeserializer and MapDeserializer in version 2.2.3 do not support @JsonIdentityInfo forward references at all." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" }, "action_statement": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.2.3-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.2.3-tuxcare.6" } } ], "timestamp": "2026-11-12T07:54:50.823954+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.2.3-tuxcare.6.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }