{
  "@id": "urn:uuid:a45f92a6-8895-4784-8b3e-5ba2d061411d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T12:39:04.437337+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-15095 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves unsafe polymorphic deserialization allowing arbitrary code execution through malicious class instantiation. The fix (blacklisting dangerous classes in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.4 release that TuxCare onboarded. The blacklist includes all classes mentioned in the CVE: JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and Spring/C3P0 classes, plus many more added in subsequent security fixes. The validation is active in the main deserialization path at BeanDeserializerFactory.java:142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "CVE-2017-15095 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves unsafe polymorphic deserialization allowing arbitrary code execution through malicious class instantiation. The fix (blacklisting dangerous classes in SubTypeValidator) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.4 release that TuxCare onboarded. The blacklist includes all classes mentioned in the CVE: JdbcRowSetImpl, FileHandler, UnicastRemoteObject, and Spring/C3P0 classes, plus many more added in subsequent security fixes. The validation is active in the main deserialization path at BeanDeserializerFactory.java:142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2017-17485. The vulnerability involves unsafe polymorphic deserialization that allows remote code execution via maliciously crafted JSON containing dangerous class names. The upstream FasterXML project fixed this in December 2017 (issues #1737 and #1855) by implementing a SubTypeValidator with a comprehensive blacklist and special validation logic for Spring framework types. This fix was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target. The fix commits are authored by upstream FasterXML maintainers (andrew.tolbert@datastax.com, tatu.saloranta@iki.fi), not TuxCare, and were in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "The target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2017-17485. The vulnerability involves unsafe polymorphic deserialization that allows remote code execution via maliciously crafted JSON containing dangerous class names. The upstream FasterXML project fixed this in December 2017 (issues #1737 and #1855) by implementing a SubTypeValidator with a comprehensive blacklist and special validation logic for Spring framework types. This fix was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target. The fix commits are authored by upstream FasterXML maintainers (andrew.tolbert@datastax.com, tatu.saloranta@iki.fi), not TuxCare, and were in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.21.4-tuxcare.2. The target contains SubTypeValidator (introduced by upstream commit 2235894210) which implements a blocklist of dangerous classes that can lead to arbitrary code execution during deserialization. This blocklist includes all classes from the CVE-2017-7525 fix (InvokerTransformer, InstantiateTransformer, TemplatesImpl, etc.). The validation is unconditionally called in BeanDeserializerFactory.createBeanDeserializer() before any bean deserializer is built, blocking the attack path. The fix shipped in the upstream release 2.21.4 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.21.4-tuxcare.2. The target contains SubTypeValidator (introduced by upstream commit 2235894210) which implements a blocklist of dangerous classes that can lead to arbitrary code execution during deserialization. This blocklist includes all classes from the CVE-2017-7525 fix (InvokerTransformer, InstantiateTransformer, TemplatesImpl, etc.). The validation is unconditionally called in BeanDeserializerFactory.createBeanDeserializer() before any bean deserializer is built, blocking the attack path. The fix shipped in the upstream release 2.21.4 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 via polymorphic deserialization of org.apache.ibatis.parsing.XPathParser, allowing data exfiltration. The target version (2.21.4) is NOT affected because the upstream vendor's fix (blacklisting XPathParser in SubTypeValidator.java) was already present in the 2.21.4 release when TuxCare onboarded it. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) on May 10, 2018 (commit 27b4defc27), years before the 2.21.4 release. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 affects jackson-databind 2.0.0-2.9.5 via polymorphic deserialization of org.apache.ibatis.parsing.XPathParser, allowing data exfiltration. The target version (2.21.4) is NOT affected because the upstream vendor's fix (blacklisting XPathParser in SubTypeValidator.java) was already present in the 2.21.4 release when TuxCare onboarded it. The fix was authored by Tatu Saloranta (tatu.saloranta@iki.fi) on May 10, 2018 (commit 27b4defc27), years before the 2.21.4 release. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.21.4 is not affected by CVE-2018-12022. The vulnerability was fixed in upstream version 2.7.9.4 (June 2018) by adding blacklist entries for Jodd-db and Oracle JDBC gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to SubTypeValidator. Version 2.21.4 already contains these protections as part of its upstream codebase. The fix commit 28badf7ef6 by upstream maintainer Tatu Saloranta shipped with the upstream release and predates TuxCare's onboarding commit b3cefac5b7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "Target jackson-databind 2.21.4 is not affected by CVE-2018-12022. The vulnerability was fixed in upstream version 2.7.9.4 (June 2018) by adding blacklist entries for Jodd-db and Oracle JDBC gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) to SubTypeValidator. Version 2.21.4 already contains these protections as part of its upstream codebase. The fix commit 28badf7ef6 by upstream maintainer Tatu Saloranta shipped with the upstream release and predates TuxCare's onboarding commit b3cefac5b7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability allowed deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that could trigger JNDI/LDAP lookups when Default Typing was enabled. The upstream vendor fix, which blacklists these classes in SubTypeValidator.java, was already present in the upstream release 2.21.4 that TuxCare onboarded. The fix commit (28badf7ef60ac3e7ef151cd8e8ec010b8479226a) by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit, confirming the vulnerable code pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability allowed deserialization of Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet) that could trigger JNDI/LDAP lookups when Default Typing was enabled. The upstream vendor fix, which blacklists these classes in SubTypeValidator.java, was already present in the upstream release 2.21.4 that TuxCare onboarded. The fix commit (28badf7ef60ac3e7ef151cd8e8ec010b8479226a) by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit, confirming the vulnerable code pattern was never present in this shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14718 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns the lack of blocklisting for org.slf4j.ext.EventData in polymorphic deserialization. The fix (commit 87d29af25e) that adds this class to the blocklist was already present in the upstream release 2.21.4 before TuxCare onboarded it. The blocklist mechanism was refactored from BeanDeserializerFactory to SubTypeValidator between the old (2.6.x/2.9.x) and current (2.21.x) versions, but the same protection exists: org.slf4j.ext.EventData is in DEFAULT_NO_DESER_CLASS_NAMES (SubTypeValidator.java line 75), and validateSubType enforces this blocklist by throwing JsonMappingException for blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "CVE-2018-14718 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns the lack of blocklisting for org.slf4j.ext.EventData in polymorphic deserialization. The fix (commit 87d29af25e) that adds this class to the blocklist was already present in the upstream release 2.21.4 before TuxCare onboarded it. The blocklist mechanism was refactored from BeanDeserializerFactory to SubTypeValidator between the old (2.6.x/2.9.x) and current (2.21.x) versions, but the same protection exists: org.slf4j.ext.EventData is in DEFAULT_NO_DESER_CLASS_NAMES (SubTypeValidator.java line 75), and validateSubType enforces this blocklist by throwing JsonMappingException for blocked types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns missing blacklist entries for BlazeDS classes (blaze-ds-opt/blaze-ds-core) that could enable arbitrary code execution via polymorphic deserialization. The fix was already included in the upstream jackson-databind 2.21.4 release. The required blacklist entries are present in SubTypeValidator.java lines 74-78, added by upstream commit 0899726ec34 authored by Tatu Saloranta (upstream maintainer) on 2018-08-16. This fix was already in place when TuxCare onboarded version 2.21.4, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns missing blacklist entries for BlazeDS classes (blaze-ds-opt/blaze-ds-core) that could enable arbitrary code execution via polymorphic deserialization. The fix was already included in the upstream jackson-databind 2.21.4 release. The required blacklist entries are present in SubTypeValidator.java lines 74-78, added by upstream commit 0899726ec34 authored by Tatu Saloranta (upstream maintainer) on 2018-08-16. This fix was already in place when TuxCare onboarded version 2.21.4, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 affects jackson-databind versions before 2.9.7 by allowing polymorphic deserialization of four dangerous classes that could enable XXE attacks and other exploits. The target repository (jackson-databind 2.21.4-tuxcare.2) is not affected because the upstream fix (commit 87d29af25e) was already included in the upstream release 2.21.4 that TuxCare onboarded. The four blacklisted classes are present in SubTypeValidator.java lines 75-78, and the validation mechanism actively blocks their deserialization through SubTypeValidator.validateSubType() called from BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 affects jackson-databind versions before 2.9.7 by allowing polymorphic deserialization of four dangerous classes that could enable XXE attacks and other exploits. The target repository (jackson-databind 2.21.4-tuxcare.2) is not affected because the upstream fix (commit 87d29af25e) was already included in the upstream release 2.21.4 that TuxCare onboarded. The four blacklisted classes are present in SubTypeValidator.java lines 75-78, and the validation mechanism actively blocks their deserialization through SubTypeValidator.validateSubType() called from BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2018-14721. The vulnerability pattern (polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF) is not present because the upstream vendor (FasterXML) already included the fix in the 2.21.4 release before TuxCare onboarded it. The blocklist in SubTypeValidator.java explicitly blocks the axis2 class, and this validation is mandatory during bean deserialization. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "The target jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2018-14721. The vulnerability pattern (polymorphic deserialization of org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl enabling SSRF) is not present because the upstream vendor (FasterXML) already included the fix in the 2.21.4 release before TuxCare onboarded it. The blocklist in SubTypeValidator.java explicitly blocks the axis2 class, and this validation is mandatory during bean deserialization. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 is NOT present in jackson-databind 2.21.4. The vulnerability concerned the ability to deserialize the dangerous gadget class `org.apache.axis2.transport.jms.JMSOutTransportInfo` via polymorphic deserialization, which could lead to arbitrary code execution. The upstream fix (commit 72cd4025a22 by Tatu Saloranta in November 2018) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream 2.21.4 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 is NOT present in jackson-databind 2.21.4. The vulnerability concerned the ability to deserialize the dangerous gadget class `org.apache.axis2.transport.jms.JMSOutTransportInfo` via polymorphic deserialization, which could lead to arbitrary code execution. The upstream fix (commit 72cd4025a22 by Tatu Saloranta in November 2018) added this class to the SubTypeValidator blocklist, preventing its deserialization. This fix was already included in the upstream 2.21.4 release that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 is NOT present in jackson-databind 2.21.4. The vulnerability involves unsafe deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The upstream vendor (Tatu Saloranta) applied the fix in commit 72cd4025a229fb28ec133235003dd4616f70afaa, which added these openjpa classes to the SubTypeValidator blocklist. This fix was already present in the upstream release 2.21.4 that TuxCare onboarded, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 is NOT present in jackson-databind 2.21.4. The vulnerability involves unsafe deserialization of openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) that could enable arbitrary code execution. The upstream vendor (Tatu Saloranta) applied the fix in commit 72cd4025a229fb28ec133235003dd4616f70afaa, which added these openjpa classes to the SubTypeValidator blocklist. This fix was already present in the upstream release 2.21.4 that TuxCare onboarded, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor in polymorphic deserialization. The target (version 2.21.4) already contains the upstream fix that was committed by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 (Fix #2186) on Nov 19, 2018. This fix was shipped in upstream release 2.9.8 and all subsequent versions including 2.21.4. The blocklist entry is present at SubTypeValidator.java:81 and is enforced by BeanDeserializerFactory during deserialization. Since the fix was authored by the upstream vendor and shipped in the upstream release that TuxCare onboarded (commit b3cefac5b7), this is classified as not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind 2.x before 2.9.8 due to missing blocklist entry for org.jboss.util.propertyeditor.DocumentEditor in polymorphic deserialization. The target (version 2.21.4) already contains the upstream fix that was committed by Tatu Saloranta (tatu.saloranta@iki.fi) in commit 72cd4025a2 (Fix #2186) on Nov 19, 2018. This fix was shipped in upstream release 2.9.8 and all subsequent versions including 2.21.4. The blocklist entry is present at SubTypeValidator.java:81 and is enforced by BeanDeserializerFactory during deserialization. Since the fix was authored by the upstream vendor and shipped in the upstream release that TuxCare onboarded (commit b3cefac5b7), this is classified as not_affected with justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2018-5968. The vulnerability was fixed in upstream commit 038b471e2e (authored by Tatu Saloranta) which added two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist. This fix was already present in the upstream release 2.21.4 that TuxCare onboarded (first TuxCare commit b3cefac5b7). The vulnerable pattern does not exist in the target\u2014the blacklist entries are present at SubTypeValidator.java lines 62-63, and the validator is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType() at line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "The target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2018-5968. The vulnerability was fixed in upstream commit 038b471e2e (authored by Tatu Saloranta) which added two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) to the deserialization blacklist. This fix was already present in the upstream release 2.21.4 that TuxCare onboarded (first TuxCare commit b3cefac5b7). The vulnerable pattern does not exist in the target\u2014the blacklist entries are present at SubTypeValidator.java lines 62-63, and the validator is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType() at line 142.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 is not present in jackson-databind 2.21.4. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes. The upstream vendor (FasterXML) fixed this in versions 2.6.7.5, 2.7.9.3, 2.8.11.1, and 2.9.5 by blocking deserialization of c3p0 DataSource classes. The target version 2.21.4 already contains this upstream fix, which was shipped in the original upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 is not present in jackson-databind 2.21.4. The vulnerability allowed remote code execution via deserialization of malicious c3p0 DataSource classes. The upstream vendor (FasterXML) fixed this in versions 2.6.7.5, 2.7.9.3, 2.8.11.1, and 2.9.5 by blocking deserialization of c3p0 DataSource classes. The target version 2.21.4 already contains this upstream fix, which was shipped in the original upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 is NOT present in jackson-databind 2.21.4. The vulnerability allows arbitrary file read via polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin when Default Typing is enabled. The fix (adding MiniAdmin to the deserialization blocklist) was included in the upstream 2.9.9 release and is present in version 2.21.4, which TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:88, preventing instantiation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 is NOT present in jackson-databind 2.21.4. The vulnerability allows arbitrary file read via polymorphic deserialization of com.mysql.cj.jdbc.admin.MiniAdmin when Default Typing is enabled. The fix (adding MiniAdmin to the deserialization blocklist) was included in the upstream 2.9.9 release and is present in version 2.21.4, which TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:88, preventing instantiation of this gadget class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.21.4-tuxcare.2. The fix (commit c9ef4a10d6) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.21.4 when TuxCare onboarded it. The blocklist entry \"ch.qos.logback.core.db.DriverManagerConnectionSource\" is present at SubTypeValidator.java:91, preventing polymorphic deserialization of the danger...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.21.4-tuxcare.2. The fix (commit c9ef4a10d6) was authored by upstream maintainer Tatu Saloranta and was already included in the upstream release 2.21.4 when TuxCare onboarded it. The blocklist entry \"ch.qos.logback.core.db.DriverManagerConnectionSource\" is present at SubTypeValidator.java:91, preventing polymorphic deserialization of the danger..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability affects jackson-databind versions 2.x through 2.9.9 when Default Typing is enabled and JDOM 1.x/2.x is in the classpath, allowing arbitrary file read via polymorphic deserialization of XSLTransformer classes. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) adds org.jdom.transform.XSLTransformer and org....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability affects jackson-databind versions 2.x through 2.9.9 when Default Typing is enabled and JDOM 1.x/2.x is in the classpath, allowing arbitrary file read via polymorphic deserialization of XSLTransformer classes. The upstream fix (commit 5f7c69bba0 by Tatu Saloranta) adds org.jdom.transform.XSLTransformer and org...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 is NOT present in jackson-databind 2.21.4. The vulnerability was fixed in upstream jackson-databind versions 2.9.9.2, 2.8.11.4, and 2.7.9.6 (July 2019) by adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blocklist in SubTypeValidator.java. The target version 2.21.4, released years later, already contains this upstream fix. The dangerous classes are blocked from deserialization by the DEFAULT_NO_DESER_CLASS_NAMES blocklist enforced in BeanDeserializerFactory during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 is NOT present in jackson-databind 2.21.4. The vulnerability was fixed in upstream jackson-databind versions 2.9.9.2, 2.8.11.4, and 2.7.9.6 (July 2019) by adding net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup and ch.qos.logback.core.db.JNDIConnectionSource to the deserialization blocklist in SubTypeValidator.java. The target version 2.21.4, released years later, already contains this upstream fix. The dangerous classes are blocked from deserialization by the DEFAULT_NO_DESER_CLASS_NAMES blocklist enforced in BeanDeserializerFactory during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves polymorphic deserialization gadgets (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that enable arbitrary code execution when Default Typing is enabled. The fix, which blacklists these dangerous classes in SubTypeValidator.java, was already present in the upstream 2.21.4 release that TuxCare onboarded. Both blacklist entries exist at lines 98 and 102 of the target's SubTypeValidator.java, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves polymorphic deserialization gadgets (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that enable arbitrary code execution when Default Typing is enabled. The fix, which blacklists these dangerous classes in SubTypeValidator.java, was already present in the upstream 2.21.4 release that TuxCare onboarded. Both blacklist entries exist at lines 98 and 102 of the target's SubTypeValidator.java, preventing deserialization of these gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind's polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource. The target version 2.21.4-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in version 2.21.4 when TuxCare onboarded it. The fix adds both HikariConfig and HikariDataSource to the deserialization blocklist in SubTypeValidator.java, preventing their use as gadget classes in polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind's polymorphic deserialization of com.zaxxer.hikari.HikariConfig and HikariDataSource. The target version 2.21.4-tuxcare.2 is NOT AFFECTED because the upstream fix was already present in version 2.21.4 when TuxCare onboarded it. The fix adds both HikariConfig and HikariDataSource to the deserialization blocklist in SubTypeValidator.java, preventing their use as gadget classes in polymorphic deserialization attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14892 is NOT present in jackson-databind version 2.21.4-tuxcare.2. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The upstream vendor (FasterXML) fixed this in September 2019 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.21.4 when TuxCare onboarded it in July 2026. The target version (2.21.4) is significantly newer than the affected versions listed in the CVE (before 2.9.10, 2.8.11.5, and 2.6.7.3). The blacklist is enforced during bean deserialization through BeanDeserializerFactory._validateSubType(), which calls SubTypeValidator.instance().validateSubType() to block dangerous classes before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "CVE-2019-14892 is NOT present in jackson-databind version 2.21.4-tuxcare.2. The vulnerability allowed polymorphic deserialization of malicious objects using commons-configuration JNDI classes to achieve arbitrary code execution. The upstream vendor (FasterXML) fixed this in September 2019 by adding org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. This fix was already present in upstream version 2.21.4 when TuxCare onboarded it in July 2026. The target version (2.21.4) is significantly newer than the affected versions listed in the CVE (before 2.9.10, 2.8.11.5, and 2.6.7.3). The blacklist is enforced during bean deserialization through BeanDeserializerFactory._validateSubType(), which calls SubTypeValidator.instance().validateSubType() to block dangerous classes before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (< 2.9.10; < 2.8.11.5; < 2.6.7.3), Snyk (< 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14893: Target jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED. The upstream fix (commit 998efd7082) that adds org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist was included in upstream release 2.21.4, which TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target. SubTypeValidator properly blocks deserialization of the xalan JNDI gadget class, preventing arbitrary code execution via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "CVE-2019-14893: Target jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED. The upstream fix (commit 998efd7082) that adds org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist was included in upstream release 2.21.4, which TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target. SubTypeValidator properly blocks deserialization of the xalan JNDI gadget class, preventing arbitrary code execution via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10), NVD (>= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), cve.org (= 2.9.10; = 2.10.0), Snyk (<= 0; < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic deserialization vulnerability involving com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.21.4-tuxcare.2) already contains the upstream fix that adds HikariDataSource to the SubTypeValidator blocklist. This fix (commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db) was authored by upstream maintainer Tatu Saloranta and was already present in version 2.21.4 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3 due to a polymorphic deserialization vulnerability involving com.zaxxer.hikari.HikariDataSource. The target repository (jackson-databind 2.21.4-tuxcare.2) already contains the upstream fix that adds HikariDataSource to the SubTypeValidator blocklist. This fix (commit 73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db) was authored by upstream maintainer Tatu Saloranta and was already present in version 2.21.4 when TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16942 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns polymorphic deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) that can be exploited for remote code execution when Default Typing is enabled. The upstream fix (adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was applied by FasterXML maintainer Tatu Saloranta in commits 9593e16c and 328a0f83 (September 2019) and was already present in upstream release 2.21.4 when TuxCare onboarded it in July 2026. The blocklist validation is active by default and throws JsonMappingException during bean deserializer creation, preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "impact_statement": "CVE-2019-16942 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns polymorphic deserialization of commons-dbcp gadget classes (SharedPoolDataSource, PerUserPoolDataSource) that can be exploited for remote code execution when Default Typing is enabled. The upstream fix (adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist) was applied by FasterXML maintainer Tatu Saloranta in commits 9593e16c and 328a0f83 (September 2019) and was already present in upstream release 2.21.4 when TuxCare onboarded it in July 2026. The blocklist validation is active by default and throws JsonMappingException during bean deserializer creation, preventing instantiation of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind v2.21.4-tuxcare.2 is not affected by CVE-2019-16943. The vulnerability allowed arbitrary code execution through polymorphic deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSource classes). The fix\u2014adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java\u2014was already present in the upstream release (v2.11.2) that TuxCare onboarded. The vulnerable code pattern (unrestricted deserialization of these gadget classes) is not present because the blacklist blocks them during type validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "impact_statement": "Target jackson-databind v2.21.4-tuxcare.2 is not affected by CVE-2019-16943. The vulnerability allowed arbitrary code execution through polymorphic deserialization of dangerous gadget classes (com.p6spy.engine.spy.P6DataSource and commons-dbcp DataSource classes). The fix\u2014adding these classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java\u2014was already present in the upstream release (v2.11.2) that TuxCare onboarded. The vulnerable code pattern (unrestricted deserialization of these gadget classes) is not present because the blacklist blocks them during type validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target repository jackson-databind 2.21.4-tuxcare.2 is NOT vulnerable to CVE-2019-17267. The vulnerable class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup is blocked in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist (line 99), preventing polymorphic deserialization attacks. This fix was shipped in upstream FasterXML release via commit 191a4cdf87 (authored by Tatu Saloranta) before TuxCare onboarded version 2.21.4. The blacklist is actively enforced during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "Target repository jackson-databind 2.21.4-tuxcare.2 is NOT vulnerable to CVE-2019-17267. The vulnerable class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup is blocked in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blacklist (line 99), preventing polymorphic deserialization attacks. This fix was shipped in upstream FasterXML release via commit 191a4cdf87 (authored by Tatu Saloranta) before TuxCare onboarded version 2.21.4. The blacklist is actively enforced during deserialization by BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17531 affects jackson-databind when Default Typing is enabled and apache-log4j-extras (1.2.x) is in the classpath, allowing malicious payload execution via polymorphic deserialization of JNDIConnectionSource or DriverManagerConnectionSource. The target repository (jackson-databind 2.21.4-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream release 2.21.4 before TuxCare onboarded it. The fix (commit b5a304a985 by upstream maintainer Tatu Saloranta, dated Oct 12, 2019) adds both log4j-extras classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "impact_statement": "CVE-2019-17531 affects jackson-databind when Default Typing is enabled and apache-log4j-extras (1.2.x) is in the classpath, allowing malicious payload execution via polymorphic deserialization of JNDIConnectionSource or DriverManagerConnectionSource. The target repository (jackson-databind 2.21.4-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream release 2.21.4 before TuxCare onboarded it. The fix (commit b5a304a985 by upstream maintainer Tatu Saloranta, dated Oct 12, 2019) adds both log4j-extras classes to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing their instantiation during polymorphic deserialization. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.1; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.1), Snyk (>= 2.0.0, < 2.9.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-20330 affects jackson-databind versions lacking blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector. The target version 2.21.4-tuxcare.2 contains these blocklist entries (SubTypeValidator.java lines 134-135), preventing deserialization of the dangerous classes. The fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883 and shipped in upstream release 2.21.4 before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "impact_statement": "CVE-2019-20330 affects jackson-databind versions lacking blocklist entries for net.sf.ehcache.transaction.manager.selector.GenericJndiSelector and GlassfishSelector. The target version 2.21.4-tuxcare.2 contains these blocklist entries (SubTypeValidator.java lines 134-135), preventing deserialization of the dangerous classes. The fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit fc4214a883 and shipped in upstream release 2.21.4 before TuxCare onboarded it. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.2), Snyk (< 2.9.10.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2020-10650. The vulnerability involves unsafe deserialization of ignite-jta classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) that could lead to arbitrary code execution. The upstream fix (commit a424c038ba from 2020-03-15) added these classes to jackson-databind's SubTypeValidator blocklist. This fix was already present in upstream version 2.21.4 before TuxCare onboarded it, so the target inherited the fix from the upstream release rather than through a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "impact_statement": "Target version 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2020-10650. The vulnerability involves unsafe deserialization of ignite-jta classes (org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider) that could lead to arbitrary code execution. The upstream fix (commit a424c038ba from 2020-03-15) added these classes to jackson-databind's SubTypeValidator blocklist. This fix was already present in upstream version 2.21.4 before TuxCare onboarded it, so the target inherited the fix from the upstream release rather than through a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.9.10.4), NVD (< 2.9.10.4; = 2.10.0-prerelease1; = 2.10.0-prerelease2; = 2.10.0-prerelease3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.21.4-tuxcare.2, which is significantly newer. The vulnerability involves deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by tatu.saloranta@iki.fi) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded (commit b3cefac5b7304afd80e856ebf312781488936df5). The blocklist entries appear at lines 162-164 of SubTypeValidator.java, preventing deserialization of the vulnerable gadget class. Since the fix was authored by the upstream maintainer and shipped in the upstream release (not backported by TuxCare), the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "impact_statement": "CVE-2020-10672 affects jackson-databind versions before 2.9.10.4. The target repository is jackson-databind version 2.21.4-tuxcare.2, which is significantly newer. The vulnerability involves deserialization of the gadget class org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory. The upstream fix (commit 592872f4235c7f2a3280725278da55544032f72d by tatu.saloranta@iki.fi) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded (commit b3cefac5b7304afd80e856ebf312781488936df5). The blocklist entries appear at lines 162-164 of SubTypeValidator.java, preventing deserialization of the vulnerable gadget class. Since the fix was authored by the upstream maintainer and shipped in the upstream release (not backported by TuxCare), the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2020-10673. The upstream fix that blocks deserialization of com.caucho.config.types.ResourceRef was already present in the upstream release 2.21.4 when TuxCare onboarded it. The vulnerable code pattern does not exist in the current version because the gadget class has been added to the deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java at line 167.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "impact_statement": "The target repository jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2020-10673. The upstream fix that blocks deserialization of com.caucho.config.types.ResourceRef was already present in the upstream release 2.21.4 when TuxCare onboarded it. The vulnerable code pattern does not exist in the current version because the gadget class has been added to the deserialization blocklist (DEFAULT_NO_DESER_CLASS_NAMES) in SubTypeValidator.java at line 167.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.4; >= 2.0.0, < 2.6.7.4), NVD (>= 2.0.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.21.4-tuxcare.2) is not affected by CVE-2020-10968. The vulnerability concerns deserialization of dangerous gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. These classes are blocklisted in SubTypeValidator.java (lines 170-171), preventing their deserialization. The fix was authored by upstream Jackson maintainer Tatu Saloranta in commit 05d7e0e13f and was already present in version 2.21.4 when TuxCare onboarded it. This is an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "impact_statement": "The target repository (jackson-databind 2.21.4-tuxcare.2) is not affected by CVE-2020-10968. The vulnerability concerns deserialization of dangerous gadget classes org.aoju.bus.proxy.provider.RmiProvider and org.aoju.bus.proxy.provider.remoting.RmiProvider. These classes are blocklisted in SubTypeValidator.java (lines 170-171), preventing their deserialization. The fix was authored by upstream Jackson maintainer Tatu Saloranta in commit 05d7e0e13f and was already present in version 2.21.4 when TuxCare onboarded it. This is an upstream fix that shipped in the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.21.4) is NOT affected by CVE-2020-10969. The vulnerability (deserialization gadget via javax.swing.JEditorPane) was fixed by upstream FasterXML in March 2020 (commit 4d038c9de0). The fix adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of this dangerous class. This upstream fix was already present in version 2.21.4 when TuxCare onboarded it, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "impact_statement": "The target repository (jackson-databind 2.21.4) is NOT affected by CVE-2020-10969. The vulnerability (deserialization gadget via javax.swing.JEditorPane) was fixed by upstream FasterXML in March 2020 (commit 4d038c9de0). The fix adds javax.swing.JEditorPane to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java, preventing deserialization of this dangerous class. This upstream fix was already present in version 2.21.4 when TuxCare onboarded it, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), cve.org (>= 2.0.0, < 2.9.10.4), Snyk (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11111 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns unsafe deserialization of org.apache.activemq.* gadget classes. The fix (blacklisting 9 ActiveMQ classes in SubTypeValidator.java) was already present in the upstream 2.21.4 release that TuxCare onboarded. Commit 08fbfacf89 added the fix upstream before TuxCare's onboarding commit b3cefac5b7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "impact_statement": "CVE-2020-11111 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns unsafe deserialization of org.apache.activemq.* gadget classes. The fix (blacklisting 9 ActiveMQ classes in SubTypeValidator.java) was already present in the upstream 2.21.4 release that TuxCare onboarded. Commit 08fbfacf89 added the fix upstream before TuxCare's onboarding commit b3cefac5b7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11112 affects jackson-databind versions before 2.9.10.4. The target repository is at version 2.21.4-tuxcare.2, which is significantly newer. The vulnerability involves a deserialization gadget (org.apache.commons.proxy.provider.remoting.RmiProvider) that could enable remote code execution when polymorphic typing is enabled. The fix blocks this class in SubTypeValidator's deny-list. Analysis confirms the fix is present in the target at SubTypeValidator.java:186. The fix was introduced in upstream commit 05d7e0e13f by FasterXML maintainer Tatu Saloranta and was already included in the upstream 2.21.4 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "impact_statement": "CVE-2020-11112 affects jackson-databind versions before 2.9.10.4. The target repository is at version 2.21.4-tuxcare.2, which is significantly newer. The vulnerability involves a deserialization gadget (org.apache.commons.proxy.provider.remoting.RmiProvider) that could enable remote code execution when polymorphic typing is enabled. The fix blocks this class in SubTypeValidator's deny-list. Analysis confirms the fix is present in the target at SubTypeValidator.java:186. The fix was introduced in upstream commit 05d7e0e13f by FasterXML maintainer Tatu Saloranta and was already included in the upstream 2.21.4 release that TuxCare onboarded. The vulnerable pattern (missing blocklist entry) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2020-11113. The vulnerability was fixed upstream in version 2.9.10.4 (March 2020) by adding org.apache.openjpa.ee.WASRegistryManagedRuntime to the deserialization blocklist. This fix was already present in the upstream 2.21.4 release that TuxCare onboarded, as confirmed by commit e2ba12d5d6 being an ancestor of the first TuxCare onboarding commit. The target version is significantly newer than the affected range (before 2.9.10.4) and contains the complete blocklist defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "impact_statement": "The target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2020-11113. The vulnerability was fixed upstream in version 2.9.10.4 (March 2020) by adding org.apache.openjpa.ee.WASRegistryManagedRuntime to the deserialization blocklist. This fix was already present in the upstream 2.21.4 release that TuxCare onboarded, as confirmed by commit e2ba12d5d6 being an ancestor of the first TuxCare onboarding commit. The target version is significantly newer than the affected range (before 2.9.10.4) and contains the complete blocklist defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), cve.org (< 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-11619 is NOT present in jackson-databind 2.21.4. The vulnerability involves missing blocklist entries for two Spring classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) in SubTypeValidator that would allow deserialization gadget attacks. The fix (commit 113e89fb08) was already present in upstream release 2.21.4 when TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta. The vulnerable code pattern (missing blocklist entries) does not exist in the target - both classes are properly blocked at SubTypeValidator.java lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "impact_statement": "CVE-2020-11619 is NOT present in jackson-databind 2.21.4. The vulnerability involves missing blocklist entries for two Spring classes (MethodLocatingFactoryBean and BeanReferenceFactoryBean) in SubTypeValidator that would allow deserialization gadget attacks. The fix (commit 113e89fb08) was already present in upstream release 2.21.4 when TuxCare onboarded it, authored by upstream maintainer Tatu Saloranta. The vulnerable code pattern (missing blocklist entries) does not exist in the target - both classes are properly blocked at SubTypeValidator.java lines 53-54.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.4 is NOT AFFECTED by CVE-2020-11620. The fix for this vulnerability (blocking deserialization of org.apache.commons.jelly.impl.Embedded) was already present in the upstream jackson-databind 2.21.4 release when TuxCare onboarded it. The blocklist entry is confirmed at line 189 of SubTypeValidator.java, and the fix commit (77040d85e3) by upstream author Tatu Saloranta predates the first TuxCare commit. The vulnerability pattern (ability to deserialize the gadget class) has been removed by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "impact_statement": "Target version 2.21.4 is NOT AFFECTED by CVE-2020-11620. The fix for this vulnerability (blocking deserialization of org.apache.commons.jelly.impl.Embedded) was already present in the upstream jackson-databind 2.21.4 release when TuxCare onboarded it. The blocklist entry is confirmed at line 189 of SubTypeValidator.java, and the fix commit (77040d85e3) by upstream author Tatu Saloranta predates the first TuxCare commit. The vulnerability pattern (ability to deserialize the gadget class) has been removed by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to deserialization of dangerous gadget classes. The target version 2.21.4-tuxcare.2 contains the upstream fix that adds `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` and related classes to the deserialization blacklist in SubTypeValidator.java (lines 191-195). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.4 release, which TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "impact_statement": "CVE-2020-14060 affects jackson-databind versions before 2.9.10.5 due to deserialization of dangerous gadget classes. The target version 2.21.4-tuxcare.2 contains the upstream fix that adds `oadd.org.apache.xalan.lib.sql.JNDIConnectionPool` and related classes to the deserialization blacklist in SubTypeValidator.java (lines 191-195). The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.21.4 release, which TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14061 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerned unsafe deserialization of five Oracle JMS gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix blocks these classes from deserialization by adding them to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix is present at lines 200-204 of SubTypeValidator.java in the target. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 5c8642aeae and shipped with upstream release 2.21.4, which TuxCare then onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "impact_statement": "CVE-2020-14061 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerned unsafe deserialization of five Oracle JMS gadget classes (AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, AQjmsXAConnectionFactory). The fix blocks these classes from deserialization by adding them to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix is present at lines 200-204 of SubTypeValidator.java in the target. The fix was authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in commit 5c8642aeae and shipped with upstream release 2.21.4, which TuxCare then onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14062 is NOT present in jackson-databind 2.21.4. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which can lead to arbitrary code execution. The upstream fix (commit 840eae2ca8 by Tatu Saloranta on May 1, 2020) added this class to the deny list in SubTypeValidator.java. This fix was already present in upstream release 2.21.4 when TuxCare onboarded it on July 10, 2026. The CVE affected versions before 2.9.10.5; version 2.21.4 is substantially newer and shipped with the protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "impact_statement": "CVE-2020-14062 is NOT present in jackson-databind 2.21.4. The vulnerability involves deserialization of the gadget class com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool which can lead to arbitrary code execution. The upstream fix (commit 840eae2ca8 by Tatu Saloranta on May 1, 2020) added this class to the deny list in SubTypeValidator.java. This fix was already present in upstream release 2.21.4 when TuxCare onboarded it on July 10, 2026. The CVE affected versions before 2.9.10.5; version 2.21.4 is substantially newer and shipped with the protection already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.0.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-14195 addresses a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory that could lead to arbitrary code execution via JNDI injection. The target jackson-databind version 2.21.4 contains the upstream fix (commit f6d9c664f6) which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 207). The fix was already present in the upstream release 2.21.4 when TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport. The blocklist is actively enforced during deserialization validation, preventing instantiation of the gadget class and blocking the attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "impact_statement": "CVE-2020-14195 addresses a deserialization gadget in org.jsecurity.realm.jndi.JndiRealmFactory that could lead to arbitrary code execution via JNDI injection. The target jackson-databind version 2.21.4 contains the upstream fix (commit f6d9c664f6) which adds this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java (line 207). The fix was already present in the upstream release 2.21.4 when TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport. The blocklist is actively enforced during deserialization validation, preventing instantiation of the gadget class and blocking the attack chain.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.5), NVD (>= 2.9.0, < 2.9.10.5), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24616 is not present in jackson-databind 2.21.4. The vulnerability involves unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPDataSource through polymorphic typing. The upstream fix (commit 3d97153944, authored by Tatu Saloranta) added this class to SubTypeValidator's blocklist, preventing its instantiation during deserialization. This fix was already present in upstream release 2.21.4 when TuxCare onboarded it (first TuxCare commit b3cefac5b7). The blocklist entry at line 147 of SubTypeValidator.java blocks the vulnerable gadget class, eliminating the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "impact_statement": "CVE-2020-24616 is not present in jackson-databind 2.21.4. The vulnerability involves unsafe deserialization of br.com.anteros.dbcp.AnterosDBCPDataSource through polymorphic typing. The upstream fix (commit 3d97153944, authored by Tatu Saloranta) added this class to SubTypeValidator's blocklist, preventing its instantiation during deserialization. This fix was already present in upstream release 2.21.4 when TuxCare onboarded it (first TuxCare commit b3cefac5b7). The blocklist entry at line 147 of SubTypeValidator.java blocks the vulnerable gadget class, eliminating the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-24750 is not affecting jackson-databind 2.21.4-tuxcare.2. The vulnerability involves deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class to achieve remote code execution. The upstream fix (commit 6cc9f1a1af by tatu.saloranta@iki.fi) added JndiConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java and was already present in the upstream release 2.21.4 that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:210, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "impact_statement": "CVE-2020-24750 is not affecting jackson-databind 2.21.4-tuxcare.2. The vulnerability involves deserialization of the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class to achieve remote code execution. The upstream fix (commit 6cc9f1a1af by tatu.saloranta@iki.fi) added JndiConfiguration to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java and was already present in the upstream release 2.21.4 that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java:210, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.6), Snyk (< 2.6.7.4; >= 2.7.0, < 2.9.10.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.21.4 is not affected by CVE-2020-25649 (XXE vulnerability). The fix for this vulnerability was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded. The vulnerable code pattern (missing XXE protections in DOMDeserializer) is not present in the target because upstream author Tatu Saloranta applied the fix in commit 612f971b78c60202e9cd75a299050c8f2d724a59 (January 2020), which predates the 2.21.4 release. The fix adds two critical XML parser security features: disabling DOCTYPE declarations and preventing external DTD loading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-25649"
      },
      "impact_statement": "The target jackson-databind version 2.21.4 is not affected by CVE-2020-25649 (XXE vulnerability). The fix for this vulnerability was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded. The vulnerable code pattern (missing XXE protections in DOMDeserializer) is not present in the target because upstream author Tatu Saloranta applied the fix in commit 612f971b78c60202e9cd75a299050c8f2d724a59 (January 2020), which predates the 2.21.4 release. The fix adds two critical XML parser security features: disabling DOCTYPE declarations and preventing external DTD loading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.6.0, < 2.6.7.4; >= 2.7.0.0, < 2.9.10.7; >= 2.10.0.0, < 2.10.5.1), NVD (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1), cve.org (= 2.11.0), Snyk (>= 2.6.0, < 2.6.7.4; >= 2.9.0, < 2.9.10.7; >= 2.10.0, < 2.10.5.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2020-35490. The vulnerability pattern (ability to deserialize dangerous dbcp2 gadget classes) is not present because the upstream vendor fix was already included in version 2.21.4 before TuxCare onboarding. The fix adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This blocklist defense was authored by upstream maintainer Tatu Saloranta in commit 41b8bdb5cc and shipped in jackson-databind 2.9.10.8 (December 2020). Target version 2.21.4 includes this defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "impact_statement": "Target jackson-databind 2.21.4-tuxcare.2 is not affected by CVE-2020-35490. The vulnerability pattern (ability to deserialize dangerous dbcp2 gadget classes) is not present because the upstream vendor fix was already included in version 2.21.4 before TuxCare onboarding. The fix adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the SubTypeValidator blocklist, preventing their instantiation during polymorphic deserialization. This blocklist defense was authored by upstream maintainer Tatu Saloranta in commit 41b8bdb5cc and shipped in jackson-databind 2.9.10.8 (December 2020). Target version 2.21.4 includes this defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-35491 is NOT present in jackson-databind 2.21.4-tuxcare.1. The vulnerability involves unsafe deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The upstream fix (commit 41b8bdb5 by Tatu Saloranta, December 2020) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream Jackson 2.21.4 release that TuxCare onboarded (commit b3cefac5 by evasilev@cloudlinux.com, \"Onboard version 2.21.4\"). The blocklist entries are active at SubTypeValidator.java:217-218, blocking deserialization attempts with \"Illegal type to deserialize: prevented for security reasons\". Target version 2.21.4 (released years after the 2020 CVE affecting versions < 2.9.10.8) shipped with the fix already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "impact_statement": "CVE-2020-35491 is NOT present in jackson-databind 2.21.4-tuxcare.1. The vulnerability involves unsafe deserialization of org.apache.commons.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource gadget classes. The upstream fix (commit 41b8bdb5 by Tatu Saloranta, December 2020) added these classes to the SubTypeValidator blocklist, preventing their deserialization. This fix was already present in the upstream Jackson 2.21.4 release that TuxCare onboarded (commit b3cefac5 by evasilev@cloudlinux.com, \"Onboard version 2.21.4\"). The blocklist entries are active at SubTypeValidator.java:217-218, blocking deserialization attempts with \"Illegal type to deserialize: prevented for security reasons\". Target version 2.21.4 (released years after the 2020 CVE affecting versions < 2.9.10.8) shipped with the fix already integrated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.4 is not affected by CVE-2020-35728. The vulnerable gadget class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is already blocked in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:240. This fix (commit 1ca0388c2f by Tatu Saloranta, December 2020) was part of the upstream 2.21.4 release before TuxCare onboarded it. The SubTypeValidator.validateSubType() method is invoked during deserialization (BeanDeserializerFactory:142) and will reject any attempt to deserialize this gadget class with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "impact_statement": "The target jackson-databind 2.21.4 is not affected by CVE-2020-35728. The vulnerable gadget class `com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool` is already blocked in the DEFAULT_NO_DESER_CLASS_NAMES blocklist at SubTypeValidator.java:240. This fix (commit 1ca0388c2f by Tatu Saloranta, December 2020) was part of the upstream 2.21.4 release before TuxCare onboarded it. The SubTypeValidator.validateSubType() method is invoked during deserialization (BeanDeserializerFactory:142) and will reject any attempt to deserialize this gadget class with \"Illegal type to deserialize: prevented for security reasons\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (>= 2.0.0, < 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36179 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involved deserialization gadgets related to DriverAdapterCPDS classes that could lead to arbitrary code execution. The upstream fix (commit 3ded28aece by Tatu Saloranta) added five DriverAdapterCPDS variants to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in upstream release 2.21.4, which TuxCare onboarded at commit b3cefac5b7. All five blacklist entries are confirmed present in the target's SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "impact_statement": "CVE-2020-36179 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involved deserialization gadgets related to DriverAdapterCPDS classes that could lead to arbitrary code execution. The upstream fix (commit 3ded28aece by Tatu Saloranta) added five DriverAdapterCPDS variants to the SubTypeValidator blacklist, preventing their deserialization. This fix was already present in upstream release 2.21.4, which TuxCare onboarded at commit b3cefac5b7. All five blacklist entries are confirmed present in the target's SubTypeValidator.java at lines 123, 193, 219, 228, and 234.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.21.4-tuxcare.2 is NOT affected by CVE-2020-36180. The vulnerability involves unsafe deserialization of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS gadget class via polymorphic typing. The upstream fix (commit 3ded28aece) that adds DriverAdapterCPDS and related classes to the deserialization blacklist was already present in upstream version 2.21.4 when TuxCare onboarded it. All five DriverAdapterCPDS variants are present in SubTypeValidator.java's DEFAULT_NO_DESER_CLASS_NAMES blacklist, which prevents deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "impact_statement": "The target jackson-databind version 2.21.4-tuxcare.2 is NOT affected by CVE-2020-36180. The vulnerability involves unsafe deserialization of org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS gadget class via polymorphic typing. The upstream fix (commit 3ded28aece) that adds DriverAdapterCPDS and related classes to the deserialization blacklist was already present in upstream version 2.21.4 when TuxCare onboarded it. All five DriverAdapterCPDS variants are present in SubTypeValidator.java's DEFAULT_NO_DESER_CLASS_NAMES blacklist, which prevents deserialization of these dangerous classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36181 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns a deserialization gadget (org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS) that could be exploited for remote code execution. The upstream vendor fix (commit 3ded28aece by Tatu Saloranta) adds this class to the deserialization denylist in SubTypeValidator.java. This fix was already present in the upstream release 2.21.4 that TuxCare onboarded, so the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "impact_statement": "CVE-2020-36181 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns a deserialization gadget (org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS) that could be exploited for remote code execution. The upstream vendor fix (commit 3ded28aece by Tatu Saloranta) adds this class to the deserialization denylist in SubTypeValidator.java. This fix was already present in the upstream release 2.21.4 that TuxCare onboarded, so the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (>= 2.0.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36182 relates to a deserialization gadget vulnerability involving org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository (jackson-databind 2.21.4-tuxcare.2) is NOT AFFECTED because the upstream vendor fix was already present in the jackson-databind 2.21.4 release that TuxCare onboarded. The fix adds the vulnerable class to a deserialization blacklist in SubTypeValidator.java (line 234), preventing instantiation during polymorphic deserialization. The fix commit (3ded28aece694d0df39c9f0fa1ff385b14a8656b) by upstream maintainer Tatu Saloranta was confirmed to be an ancestor of the TuxCare onboarding commit, meaning it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "impact_statement": "CVE-2020-36182 relates to a deserialization gadget vulnerability involving org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. The target repository (jackson-databind 2.21.4-tuxcare.2) is NOT AFFECTED because the upstream vendor fix was already present in the jackson-databind 2.21.4 release that TuxCare onboarded. The fix adds the vulnerable class to a deserialization blacklist in SubTypeValidator.java (line 234), preventing instantiation during polymorphic deserialization. The fix commit (3ded28aece694d0df39c9f0fa1ff385b14a8656b) by upstream maintainer Tatu Saloranta was confirmed to be an ancestor of the TuxCare onboarding commit, meaning it shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36183 does not affect jackson-databind 2.21.4-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability in commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 by adding org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.21.4 when TuxCare onboarded it, making the vulnerable code pattern absent from the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "impact_statement": "CVE-2020-36183 does not affect jackson-databind 2.21.4-tuxcare.2. The upstream vendor (FasterXML) fixed this vulnerability in commit 12e23c962ffb4cf1857c5461d72ae54cc8008f29 by adding org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool to the deserialization blocklist in SubTypeValidator.java. This fix was already present in upstream release 2.21.4 when TuxCare onboarded it, making the vulnerable code pattern absent from the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.00, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.21.4-tuxcare.1 is not affected by CVE-2020-36184. The vulnerability was fixed in upstream version 2.9.10.8 (December 2020) by adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This upstream fix was already present in the 2.21.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36184"
      },
      "impact_statement": "The target jackson-databind 2.21.4-tuxcare.1 is not affected by CVE-2020-36184. The vulnerability was fixed in upstream version 2.9.10.8 (December 2020) by adding org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource and SharedPoolDataSource to the deserialization blocklist in SubTypeValidator.java. This upstream fix was already present in the 2.21.4 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), cve.org (< 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36185 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 567194c53a by adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded, so the vulnerable pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "impact_statement": "CVE-2020-36185 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves deserialization gadgets in org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource and PerUserPoolDataSource. The upstream vendor (FasterXML) fixed this in commit 567194c53a by adding these classes to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist. This fix was already present in the upstream jackson-databind 2.21.4 release that TuxCare onboarded, so the vulnerable pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36186 does not affect jackson-databind 2.21.4-tuxcare.2. The vulnerability relates to deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource). The fix blocking these classes was applied by upstream FasterXML in commit 3e8fa3beea and was already present in the upstream 2.21.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "impact_statement": "CVE-2020-36186 does not affect jackson-databind 2.21.4-tuxcare.2. The vulnerability relates to deserialization of dangerous gadget classes (org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource and SharedPoolDataSource). The fix blocking these classes was applied by upstream FasterXML in commit 3e8fa3beea and was already present in the upstream 2.21.4 release that TuxCare onboarded. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target (jackson-databind 2.21.4-tuxcare.2) is not affected by CVE-2020-36187. The vulnerability affects versions before 2.9.10.8. The fix blocking org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was added by upstream commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (author: tatu.saloranta@iki.fi) and shipped in upstream release 2.21.4 before TuxCare onboarded this version. The blocklist entries are present at SubTypeValidator.java lines 229-230, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "impact_statement": "The target (jackson-databind 2.21.4-tuxcare.2) is not affected by CVE-2020-36187. The vulnerability affects versions before 2.9.10.8. The fix blocking org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource and PerUserPoolDataSource was added by upstream commit 3e8fa3beea49ea62109df9e643c9cb678dabdde1 (author: tatu.saloranta@iki.fi) and shipped in upstream release 2.21.4 before TuxCare onboarded this version. The blocklist entries are present at SubTypeValidator.java lines 229-230, preventing deserialization of these dangerous gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.9.10.8), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.21.4-tuxcare.2 is NOT affected by CVE-2020-36188. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable arbitrary code execution. The upstream vendor fix (commit 33d96c13fe by Tatu Saloranta) added these class names to SubTypeValidator's deny-list, blocking their deserialization. This fix shipped in upstream version 2.21.4, which TuxCare onboarded, so the target inherits the protection. The validator is integrated into the bean deserialization pipeline and throws a security exception when blocked types are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "impact_statement": "Target jackson-databind 2.21.4-tuxcare.2 is NOT affected by CVE-2020-36188. The vulnerability involves polymorphic deserialization of malicious gadget classes (com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource and DriverManagerConnectionSource) that enable arbitrary code execution. The upstream vendor fix (commit 33d96c13fe by Tatu Saloranta) added these class names to SubTypeValidator's deny-list, blocking their deserialization. This fix shipped in upstream version 2.21.4, which TuxCare onboarded, so the target inherits the protection. The validator is integrated into the bean deserialization pipeline and throws a security exception when blocked types are encountered.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; >= 2.0.0, < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36189 is NOT present in jackson-databind 2.21.4. The vulnerability concerns deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource classes. The upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization when polymorphic typing is enabled. This fix was already included in the upstream 2.21.4 release that TuxCare onboarded (commit b3cefac5b7 \"Onboard version 2.21.4\"), making version 2.21.4 immune to this vulnerability from the start. No TuxCare backport was needed for the 2.21.x line.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "CVE-2020-36189 is NOT present in jackson-databind 2.21.4. The vulnerability concerns deserialization gadgets in com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource and JNDIConnectionSource classes. The upstream fix (commit 33d96c13fe18a2dad01b19ce195548c9acea9da4 by Tatu Saloranta) added these classes to the SubTypeValidator blocklist, preventing their deserialization when polymorphic typing is enabled. This fix was already included in the upstream 2.21.4 release that TuxCare onboarded (commit b3cefac5b7 \"Onboard version 2.21.4\"), making version 2.21.4 immune to this vulnerability from the start. No TuxCare backport was needed for the 2.21.x line.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.8; < 2.6.7.5), NVD (>= 2.0.0, < 2.6.7.5; >= 2.7.0, < 2.9.10.8), Snyk (< 2.9.10.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.21.4. The vulnerability (stack overflow from deeply nested JSON) was fixed in upstream version 2.14.0 via a non-recursive deserialization implementation, and this fix shipped with version 2.21.4 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.21.4. The vulnerability (stack overflow from deeply nested JSON) was fixed in upstream version 2.14.0 via a non-recursive deserialization implementation, and this fix shipped with version 2.21.4 when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.13.0, < 2.13.2.1; < 2.12.6.1), NVD (< 2.12.6.1; >= 2.13.0, < 2.13.2.1), Snyk (< 2.12.6.1; >= 2.13.0, < 2.13.2.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.21.4-tuxcare.2 is not affected by CVE-2020-8840. The fix (blocking deserialization of org.apache.xbean.propertyeditor.JndiConverter) was already present in the upstream release 2.21.4 before TuxCare onboarded it. Commit 914e7c9f2cb8ce66724bf26a72adc7e958992497 by upstream maintainer Tatu Saloranta added the gadget class to the SubTypeValidator blocklist, preventing JNDI injection attacks via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "impact_statement": "The target jackson-databind version 2.21.4-tuxcare.2 is not affected by CVE-2020-8840. The fix (blocking deserialization of org.apache.xbean.propertyeditor.JndiConverter) was already present in the upstream release 2.21.4 before TuxCare onboarded it. Commit 914e7c9f2cb8ce66724bf26a72adc7e958992497 by upstream maintainer Tatu Saloranta added the gadget class to the SubTypeValidator blocklist, preventing JNDI injection attacks via polymorphic deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.5; >= 2.9.0, < 2.9.10.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. The target repository jackson-databind version 2.21.4 is NOT affected by CVE-2020-9546. The vulnerable class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig is already present in the deserialization blocklist (SubTypeValidator.java:141). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.21.4 before TuxCare onboarded it. The blocklist prevents deserialization of the gadget class, blocking the attack path from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "impact_statement": "The target repository jackson-databind version 2.21.4 is NOT affected by CVE-2020-9546. The vulnerable class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig is already present in the deserialization blocklist (SubTypeValidator.java:141). This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release 2.21.4 before TuxCare onboarded it. The blocklist prevents deserialization of the gadget class, blocking the attack path from malicious JSON input to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-9547 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns deserialization gadgets related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream vendor fix (adding this class to the SubTypeValidator deny-list) was already included in upstream version 2.9.10.4 (released Feb 2020) and is present in the target's upstream base version 2.21.4. The fix commit (9f4e97019f) by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit, confirming the fix shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "impact_statement": "CVE-2020-9547 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability concerns deserialization gadgets related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig. The upstream vendor fix (adding this class to the SubTypeValidator deny-list) was already included in upstream version 2.9.10.4 (released Feb 2020) and is present in the target's upstream base version 2.21.4. The fix commit (9f4e97019f) by upstream maintainer Tatu Saloranta is an ancestor of the TuxCare onboarding commit, confirming the fix shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target version 2.21.4-tuxcare.2 is not affected by CVE-2020-9548. The fix blocking deserialization of br.com.anteros.dbcp.AnterosDBCPConfig was shipped in upstream release 2.21.4, which is significantly newer than the affected versions (before 2.9.10.4/2.8.11.6/2.7.9.7). The blocklist entry preventing the gadget class deserialization is present at SubTypeValidator.java:145, and validation is enforced in BeanDeserializerFactory.java:142 for all bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "impact_statement": "Target version 2.21.4-tuxcare.2 is not affected by CVE-2020-9548. The fix blocking deserialization of br.com.anteros.dbcp.AnterosDBCPConfig was shipped in upstream release 2.21.4, which is significantly newer than the affected versions (before 2.9.10.4/2.8.11.6/2.7.9.7). The blocklist entry preventing the gadget class deserialization is present at SubTypeValidator.java:145, and validation is enforced in BeanDeserializerFactory.java:142 for all bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10.4; >= 2.8.0, < 2.8.11.6; >= 2.0.0, < 2.7.9.7), NVD (>= 2.0.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4), Snyk (< 2.6.7.4; >= 2.7.0, < 2.7.9.7; >= 2.8.0, < 2.8.11.6; >= 2.9.0, < 2.9.10.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-20190 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves deserialization gadgets (javax.swing.JTextPane and javax.swing.JEditorPane) that can be exploited via polymorphic type handling. The target repository contains the fix in SubTypeValidator.java (lines 149-151), which blocks these gadget classes from being deserialized. This fix was already present in upstream version 2.21.4 when TuxCare onboarded it (commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream maintainer tatu.saloranta@iki.fi). The vulnerable code pattern is not present because the upstream fix shipped before TuxCare's first commit (onboard b3cefac5b7304afd80e856ebf312781488936df5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "impact_statement": "CVE-2021-20190 is not present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involves deserialization gadgets (javax.swing.JTextPane and javax.swing.JEditorPane) that can be exploited via polymorphic type handling. The target repository contains the fix in SubTypeValidator.java (lines 149-151), which blocks these gadget classes from being deserialized. This fix was already present in upstream version 2.21.4 when TuxCare onboarded it (commit 7dbf51bf78d157098074a20bd9da39bd48c18e4a by upstream maintainer tatu.saloranta@iki.fi). The vulnerable code pattern is not present because the upstream fix shipped before TuxCare's first commit (onboard b3cefac5b7304afd80e856ebf312781488936df5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.9.10.7; < 2.6.7.5), NVD (< 2.6.7.5; >= 2.7.0, < 2.9.10.7), cve.org (= 2.9.10.7), Snyk (< 2.6.7.5; >= 2.7.0-rc1, < 2.9.10.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2021-46877 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involved unvalidated heap allocation during JDK deserialization of JsonNode objects, where an attacker-controlled length field could trigger excessive memory allocation (up to 2GB). The upstream fix by Tatu Saloranta (commit 3ccde7d938) was already included in upstream release 2.21.4 before TuxCare onboarded it. The target code contains the complete fix: NodeSerialization._read() limits eager allocation to 100KB and uses chunked reading via ByteArrayBuilder for larger payloads, preventing the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "impact_statement": "CVE-2021-46877 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability involved unvalidated heap allocation during JDK deserialization of JsonNode objects, where an attacker-controlled length field could trigger excessive memory allocation (up to 2GB). The upstream fix by Tatu Saloranta (commit 3ccde7d938) was already included in upstream release 2.21.4 before TuxCare onboarded it. The target code contains the complete fix: NodeSerialization._read() limits eager allocation to 100KB and uses chunked reading via ByteArrayBuilder for larger payloads, preventing the attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.12.6; >= 2.13.0, < 2.13.1), NVD (>= 2.10.0, < 2.12.6; = 2.13.0; = 2.13.0-rc1; = 2.13.0-rc2), Snyk (>= 2.13.0, < 2.13.1; >= 2.10.0.pr1, < 2.12.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2022-42003 fix was already included in upstream jackson-databind 2.21.4 release. The target version (2.21.4-tuxcare.2) contains the upstream fix commit 2c4a601c62 authored by Richard Zowalla, which adds checks in primitive value deserializers to prevent deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. The fix detects nested START_ARRAY tokens and rejects them via the handleNestedArrayForSingle() method, preventing resource exhaustion. This fix was present in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "impact_statement": "CVE-2022-42003 fix was already included in upstream jackson-databind 2.21.4 release. The target version (2.21.4-tuxcare.2) contains the upstream fix commit 2c4a601c62 authored by Richard Zowalla, which adds checks in primitive value deserializers to prevent deep wrapper array nesting when UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. The fix detects nested START_ARRAY tokens and rejects them via the handleNestedArrayForSingle() method, preventing resource exhaustion. This fix was present in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4.2), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4.1), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. Target is NOT affected by CVE-2022-42004. The fix preventing deeply nested array resource exhaustion is present in BeanDeserializer._deserializeFromArray() at lines 674-682. This fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit 063183589218fec19a9293ed2f17ec53ea80ba88 and shipped in upstream release 2.21.4, which TuxCare later onboarded in commit b3cefac5b7 (evasilev@cloudlinux.com). The vulnerable pattern is not present because the upstream vendor fix was already included in the 2.21.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "impact_statement": "Target is NOT affected by CVE-2022-42004. The fix preventing deeply nested array resource exhaustion is present in BeanDeserializer._deserializeFromArray() at lines 674-682. This fix was authored by upstream vendor Tatu Saloranta (tatu.saloranta@iki.fi) in commit 063183589218fec19a9293ed2f17ec53ea80ba88 and shipped in upstream release 2.21.4, which TuxCare later onboarded in commit b3cefac5b7 (evasilev@cloudlinux.com). The vulnerable pattern is not present because the upstream vendor fix was already included in the 2.21.4 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4.0-rc1, < 2.12.7.1; >= 2.13.0, < 2.13.4), NVD (< 2.12.7.1; >= 2.13.0, < 2.13.4), Snyk (>= 2.4.0, < 2.12.7.1; >= 2.13.0, < 2.13.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-50193 is not present in jackson-databind 2.21.4. The vulnerable recursive serialization pattern in InternalNodeMapper._serializeNonRecursive() was fixed in upstream commit a1fa4ae4ec (Fix #3447) by converting recursive calls to iterative processing with an explicit IteratorStack. This fix was part of upstream release 2.14.0 and shipped with the 2.21.4 release that TuxCare onboarded, so...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-50193 is not present in jackson-databind 2.21.4. The vulnerable recursive serialization pattern in InternalNodeMapper._serializeNonRecursive() was fixed in upstream commit a1fa4ae4ec (Fix #3447) by converting recursive calls to iterative processing with an explicit IteratorStack. This fix was part of upstream release 2.14.0 and shipped with the 2.21.4 release that TuxCare onboarded, so..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 Target jackson-databind 2.21.4 (SHA 42ff7b0f7) already contains the complete fix for CVE-2026-54512. The vulnerability (PolymorphicTypeValidator bypass via generic type parameters) is addressed by recursive type parameter validation in DatabindContext._resolveAndValidateGeneric() and BasicPolymorphicTypeValidator.validateSubType(). Git history confirms upstream fix commits 434d6c511 and 26a8c70...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "impact_statement": "already_fixed \u2014 Target jackson-databind 2.21.4 (SHA 42ff7b0f7) already contains the complete fix for CVE-2026-54512. The vulnerability (PolymorphicTypeValidator bypass via generic type parameters) is addressed by recursive type parameter validation in DatabindContext._resolveAndValidateGeneric() and BasicPolymorphicTypeValidator.validateSubType(). Git history confirms upstream fix commits 434d6c511 and 26a8c70..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. CVE-2026-54513 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability was fixed by the upstream vendor (FasterXML) in version 2.21.4 before TuxCare onboarded it. Fix commit 01d1692c8d by Tatu Saloranta (upstream maintainer) is present in HEAD's ancestry. The vulnerable pattern (allowIfSubTypeIsArray() blindly accepting all arrays without validating component types) has been replaced with proper recursive array unwrapping and component type validation against the configured allowlist. Code inspection confirms all fix elements are present: the _acceptArrayTypes flag, modified allowIfSubTypeIsArray() behavior, and validateSubType() logic that recursively unwraps arrays to validate concrete component types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), NVD (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), cve.org (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), Snyk (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "impact_statement": "CVE-2026-54513 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability was fixed by the upstream vendor (FasterXML) in version 2.21.4 before TuxCare onboarded it. Fix commit 01d1692c8d by Tatu Saloranta (upstream maintainer) is present in HEAD's ancestry. The vulnerable pattern (allowIfSubTypeIsArray() blindly accepting all arrays without validating component types) has been replaced with proper recursive array unwrapping and component type validation against the configured allowlist. Code inspection confirms all fix elements are present: the _acceptArrayTypes flag, modified allowIfSubTypeIsArray() behavior, and validateSubType() logic that recursively unwraps arrays to validate concrete component types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), NVD (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), cve.org (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4; >= 3.0.0, < 3.1.4), Snyk (>= 2.10.0, < 2.18.8; >= 2.19.0, < 2.21.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.21.4 is the fixed version released by upstream FasterXML. The vulnerability (CVE-2026-54514) affected JDKFromStringDeserializer which used `new InetSocketAddress(host, port)` causing eager DNS resolution at deserialization time. The fix (commit 1f5a1037b1) replaced this with `InetSocketAddress.createUnresolved(host, port)` to defer DNS resolution. This fix was already present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "impact_statement": "not_affected \u2014 Target version 2.21.4 is the fixed version released by upstream FasterXML. The vulnerability (CVE-2026-54514) affected JDKFromStringDeserializer which used `new InetSocketAddress(host, port)` causing eager DNS resolution at deserialization time. The fix (commit 1f5a1037b1) replaced this with `InetSocketAddress.createUnresolved(host, port)` to defer DNS resolution. This fix was already present i..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54516 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability allowed attackers to bypass @JsonIgnore setter restrictions by writing to private backing fields via inferred field mutators when MapperFeature.INFER_PROPERTY_MUTATORS was enabled. The fix (commit c3d56dd25d, issue #5967/#5968) was already included in the upstream 2.21.4 release that TuxCare onboarded. The fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54516 is NOT present in jackson-databind 2.21.4-tuxcare.2. The vulnerability allowed attackers to bypass @JsonIgnore setter restrictions by writing to private backing fields via inferred field mutators when MapperFeature.INFER_PROPERTY_MUTATORS was enabled. The fix (commit c3d56dd25d, issue #5967/#5968) was already included in the upstream 2.21.4 release that TuxCare onboarded. The fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54517 affects jackson-databind versions >= 2.21.0, < 2.21.4. The target is version 2.21.4-tuxcare.2, which contains the upstream fix (commit 94c5d215b3) that shipped in the jackson-databind 2.21.4 release. The fix adds a view-visibility check in BeanDeserializer._deserializeUsingPropertyBased() to prevent setterless properties with restricted @JsonView annotations from being populated ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54517 affects jackson-databind versions >= 2.21.0, < 2.21.4. The target is version 2.21.4-tuxcare.2, which contains the upstream fix (commit 94c5d215b3) that shipped in the jackson-databind 2.21.4 release. The fix adds a view-visibility check in BeanDeserializer._deserializeUsingPropertyBased() to prevent setterless properties with restricted @JsonView annotations from being populated ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2026-54518. The vulnerability (bypassing @JsonView restrictions for @JsonUnwrapped creator parameters) was fixed in the upstream jackson-databind 2.21.4 release via commit 721fa07ebb. The fix adds activeView visibility checks to UnwrappedPropertyHandler.processUnwrappedCreatorProperties() and related deserializer paths, preventing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Target jackson-databind 2.21.4-tuxcare.2 is NOT AFFECTED by CVE-2026-54518. The vulnerability (bypassing @JsonView restrictions for @JsonUnwrapped creator parameters) was fixed in the upstream jackson-databind 2.21.4 release via commit 721fa07ebb. The fix adds activeView visibility checks to UnwrappedPropertyHandler.processUnwrappedCreatorProperties() and related deserializer paths, preventing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 The target jackson-databind 2.21.4-tuxcare.2 is NOT affected by CVE-2026-59888. The vulnerability (a @JsonIgnore bypass for Java Records when using PropertyNamingStrategy) has been fixed by upstream commit c7c678360624da5bc7eed2152789fa522880db9d (authored by tatu.saloranta@iki.fi), which was already present in the upstream 2.21.4 release before TuxCare onboarded it. The fix adds the renamed pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 The target jackson-databind 2.21.4-tuxcare.2 is NOT affected by CVE-2026-59888. The vulnerability (a @JsonIgnore bypass for Java Records when using PropertyNamingStrategy) has been fixed by upstream commit c7c678360624da5bc7eed2152789fa522880db9d (authored by tatu.saloranta@iki.fi), which was already present in the upstream 2.21.4 release before TuxCare onboarded it. The fix adds the renamed pr..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.21.4-tuxcare.4 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T12:39:04.437337+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.21.4-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}