{ "@id": "urn:uuid:60f27574-2b6e-4174-a3b9-cef74403fa3a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T12:59:00.060060+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2017-15095 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-15095" }, "action_statement": "Vulnerability CVE-2017-15095 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2017-17485 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-17485" }, "action_statement": "Vulnerability CVE-2017-17485 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 is NOT present in jackson-databind 2.9.1-tuxcare.2. The vulnerability pattern has been removed by upstream fix commit 6ce32ffd18 authored by Tatu Saloranta (tatu.saloranta@iki.fi), which was already included in the upstream 2.9.1 release. The target contains comprehensive blacklist validation that blocks deserialization of dangerous gadget classes before bean deserializer creation, preventing the polymorphic deserialization attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7525" }, "impact_statement": "CVE-2017-7525 is NOT present in jackson-databind 2.9.1-tuxcare.2. The vulnerability pattern has been removed by upstream fix commit 6ce32ffd18 authored by Tatu Saloranta (tatu.saloranta@iki.fi), which was already included in the upstream 2.9.1 release. The target contains comprehensive blacklist validation that blocks deserialization of dangerous gadget classes before bean deserializer creation, preventing the polymorphic deserialization attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-11307 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2018-12022 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12022" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2018-12023 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12023" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-14718 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14718" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-14719 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14719" }, "action_statement": "Vulnerability CVE-2018-14719 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-14720 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14720" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-14721 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14721" }, "action_statement": "Vulnerability CVE-2018-14721 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2018-19360 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19360" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2018-19361 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19361" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-19362 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-5968 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-5968" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2018-7489 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-12086 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-12384 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-12814 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-14379 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-14540 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14540" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14892" }, "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2019-14893 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14893" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-16335 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16335" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-17267 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17267" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-10672 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-11111 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-11620 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-25649" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36180 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:59:00.060060+00:00", "status_notes": "Vulnerability CVE-2020-9546 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-110879" }, "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-50193 does not affect version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 jackson-databind 2.9.1 contains recursive toString() implementations in ObjectNode and ArrayNode that would cause StackOverflowError with deeply nested JSON structures. However, as a library, jackson-databind does not call these toString() methods on attacker-controlled JsonNodes in its own production code paths. The vulnerability only manifests when downstream applications explicitly call toSt...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-50193" }, "impact_statement": "not_affected \u2014 jackson-databind 2.9.1 contains recursive toString() implementations in ObjectNode and ArrayNode that would cause StackOverflowError with deeply nested JSON structures. However, as a library, jackson-databind does not call these toString() methods on attacker-controlled JsonNodes in its own production code paths. The vulnerability only manifests when downstream applications explicitly call toSt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.1 is not affected by CVE-2026-54512. The vulnerability is a bypass of PolymorphicTypeValidator (PTV) validation when generic type parameters are present in polymorphic type IDs. PTV and the vulnerable method `_resolveAndValidateGeneric()` were introduced in version 2.10.0. Since 2.9.1 predates PTV's introduction, the vulnerable code pattern does not exist. The CVE explicitly states the affected range as \"from 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\". TuxCare backported the fix to versions 2.14.1, 2.14.2, 2.17.2, and 2.17.3 but not to 2.9.1, confirming that 2.9.1 does not require the fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.1 is not affected by CVE-2026-54512. The vulnerability is a bypass of PolymorphicTypeValidator (PTV) validation when generic type parameters are present in polymorphic type IDs. PTV and the vulnerable method `_resolveAndValidateGeneric()` were introduced in version 2.10.0. Since 2.9.1 predates PTV's introduction, the vulnerable code pattern does not exist. The CVE explicitly states the affected range as \"from 2.10.0 until 2.18.8, 2.21.4, and 3.1.4\". TuxCare backported the fix to versions 2.14.1, 2.14.2, 2.17.2, and 2.17.3 but not to 2.9.1, confirming that 2.9.1 does not require the fix." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target version 2.9.1 does not have the vulnerable code path. CVE-2026-54518 affects UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), a method that handles @JsonUnwrapped with @JsonCreator combinations. This feature was added in version 2.19 (Nov 2024, commit 502fe888da). Version 2.9.1 predates this feature and actively rejects the combination by throwing \"Cannot define Creator para...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54518" }, "impact_statement": "not_affected \u2014 Target version 2.9.1 does not have the vulnerable code path. CVE-2026-54518 affects UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), a method that handles @JsonUnwrapped with @JsonCreator combinations. This feature was added in version 2.19 (Nov 2024, commit 502fe888da). Version 2.9.1 predates this feature and actively rejects the combination by throwing \"Cannot define Creator para..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.1 is not affected by CVE-2026-59888. The vulnerability specifically targets Java Records with @JsonIgnore and PropertyNamingStrategy, but version 2.9.1 predates Java Records support. Released in September 2017 targeting Java 7, this version has zero Record infrastructure. The CVE explicitly states affected versions >= 2.15.0, while the target is 2.9.1. For regular POJOs in 2.9.1, @J...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59888" }, "impact_statement": "not_affected \u2014 Version 2.9.1 is not affected by CVE-2026-59888. The vulnerability specifically targets Java Records with @JsonIgnore and PropertyNamingStrategy, but version 2.9.1 predates Java Records support. Released in September 2017 targeting Java 7, this version has zero Record infrastructure. The CVE explicitly states affected versions >= 2.15.0, while the target is 2.9.1. For regular POJOs in 2.9.1, @J..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-83557 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.1-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1-tuxcare.6" } } ], "timestamp": "2026-11-12T12:58:09.356430+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.1-tuxcare.6.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }