{
  "@id": "urn:uuid:36c9e965-0a96-4ded-8414-35c3bbf5a5c3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T10:29:13.238602+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.10 is not affected by CVE-2017-15095. The vulnerability required specific gadget classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/c3p0 classes) to be deserializable via polymorphic deserialization. The upstream Jackson project fixed this in versions 2.8.11 and 2.9.4 by adding these classes to a deserialization blacklist. The target version 2.9.10 already contains these upstream fixes (commits e8f043d1aa for #1680 and ddfddfba64 for #1737, both authored by tatu.saloranta@iki.fi), which shipped in the upstream release before TuxCare's onboarding. All required blacklist entries are present in SubTypeValidator.java and are properly enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "Target version 2.9.10 is not affected by CVE-2017-15095. The vulnerability required specific gadget classes (JdbcRowSetImpl, FileHandler, UnicastRemoteObject, Spring/c3p0 classes) to be deserializable via polymorphic deserialization. The upstream Jackson project fixed this in versions 2.8.11 and 2.9.4 by adding these classes to a deserialization blacklist. The target version 2.9.10 already contains these upstream fixes (commits e8f043d1aa for #1680 and ddfddfba64 for #1737, both authored by tatu.saloranta@iki.fi), which shipped in the upstream release before TuxCare's onboarding. All required blacklist entries are present in SubTypeValidator.java and are properly enforced during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 addresses an incomplete deserialization blacklist in jackson-databind that allowed remote code execution when Spring libraries are available. The upstream fixes (issues #1737 and #1855) added dangerous classes to the blacklist and implemented pattern-based validation in the SubTypeValidator class. These fixes were already present in the upstream jackson-databind 2.9.10 release that TuxCare onboarded. The target repository at HEAD (2.9.10-tuxcare.3, SHA 54cdcdd4be) contains the complete fix, including all blacklist entries and validation logic. Verdict: not_affected because the vulnerable code pattern is not present\u2014the upstream vendor fix shipped in the 2.9.10 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 addresses an incomplete deserialization blacklist in jackson-databind that allowed remote code execution when Spring libraries are available. The upstream fixes (issues #1737 and #1855) added dangerous classes to the blacklist and implemented pattern-based validation in the SubTypeValidator class. These fixes were already present in the upstream jackson-databind 2.9.10 release that TuxCare onboarded. The target repository at HEAD (2.9.10-tuxcare.3, SHA 54cdcdd4be) contains the complete fix, including all blacklist entries and validation logic. Verdict: not_affected because the vulnerable code pattern is not present\u2014the upstream vendor fix shipped in the 2.9.10 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.10 already contains the upstream vendor's fix, which was shipped in the upstream 2.9.10 release that TuxCare onboarded. The defense mechanism (SubTypeValidator) blocks deserialization of dangerous classes including TemplatesImpl and other gadget classes through a comprehensive blacklist check executed during bean deserializer creation. The vulnerable pattern (unvalidated polymorphic deserialization of arbitrary classes) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "CVE-2017-7525 affects jackson-databind versions before 2.6.7.1, 2.7.9.1, and 2.8.9. The target version 2.9.10 already contains the upstream vendor's fix, which was shipped in the upstream 2.9.10 release that TuxCare onboarded. The defense mechanism (SubTypeValidator) blocks deserialization of dangerous classes including TemplatesImpl and other gadget classes through a comprehensive blacklist check executed during bean deserializer creation. The vulnerable pattern (unvalidated polymorphic deserialization of arbitrary classes) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-11307 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability involved deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser to enable data exfiltration via XML external entities. The fix (blacklisting this class) was introduced by upstream FasterXML in commit 27b4defc27 (May 2018) and shipped in upstream release 2.9.6. When TuxCare onboarded version 2.9.10 in commit 0790041fa, the fix was already present in the upstream codebase. The blacklist entry exists at SubTypeValidator.java:62 and is actively enforced during deserialization at BeanDeserializerFactory.java:919.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "CVE-2018-11307 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability involved deserialization of the iBatis gadget class org.apache.ibatis.parsing.XPathParser to enable data exfiltration via XML external entities. The fix (blacklisting this class) was introduced by upstream FasterXML in commit 27b4defc27 (May 2018) and shipped in upstream release 2.9.6. When TuxCare onboarded version 2.9.10 in commit 0790041fa, the fix was already present in the upstream codebase. The blacklist entry exists at SubTypeValidator.java:62 and is actively enforced during deserialization at BeanDeserializerFactory.java:919.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12022 affects jackson-databind versions prior to 2.9.6. The target version 2.9.10 includes the upstream fix that blacklists the vulnerable Jodd-db and Oracle JDBC gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet). These entries were added to SubTypeValidator by upstream commits 28badf7ef60 and 7487cf7eb14 (author: tatu.saloranta@iki.fi) which shipped in the upstream release before TuxCare onboarded version 2.9.10. The blacklist prevents polymorphic deserialization of these dangerous classes, blocking the JNDI/LDAP injection attack vector. Verdict: not_affected (upstream fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "CVE-2018-12022 affects jackson-databind versions prior to 2.9.6. The target version 2.9.10 includes the upstream fix that blacklists the vulnerable Jodd-db and Oracle JDBC gadget classes (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet). These entries were added to SubTypeValidator by upstream commits 28badf7ef60 and 7487cf7eb14 (author: tatu.saloranta@iki.fi) which shipped in the upstream release before TuxCare onboarded version 2.9.10. The blacklist prevents polymorphic deserialization of these dangerous classes, blocking the JNDI/LDAP injection attack vector. Verdict: not_affected (upstream fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 does not affect jackson-databind version 2.9.10. The vulnerability allows remote code execution via JNDI/LDAP injection when polymorphic typing is enabled and Oracle JDBC classes are deserialized. The upstream fix (commit 28badf7ef6) that blocklists the dangerous Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) was already included in the 2.9.10 release before TuxCare onboarding. The blocklist is present in SubTypeValidator.java lines 67-69 and is actively enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 does not affect jackson-databind version 2.9.10. The vulnerability allows remote code execution via JNDI/LDAP injection when polymorphic typing is enabled and Oracle JDBC classes are deserialized. The upstream fix (commit 28badf7ef6) that blocklists the dangerous Oracle JDBC classes (oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet) was already included in the 2.9.10 release before TuxCare onboarding. The blocklist is present in SubTypeValidator.java lines 67-69 and is actively enforced during bean deserialization via BeanDeserializerFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10-tuxcare.3 is NOT affected by CVE-2018-14718. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable arbitrary code execution. The fix blocking these four classes was already present in the upstream jackson-databind 2.9.10 release (commit 0899726ec34 by Tatu Saloranta on 2018-08-16), which TuxCare onboarded as the base version. The blocklist is implemented in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES and enforced on every polymorphic deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target jackson-databind 2.9.10-tuxcare.3 is NOT affected by CVE-2018-14718. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that could enable arbitrary code execution. The fix blocking these four classes was already present in the upstream jackson-databind 2.9.10 release (commit 0899726ec34 by Tatu Saloranta on 2018-08-16), which TuxCare onboarded as the base version. The blocklist is implemented in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES and enforced on every polymorphic deserialization path via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.9.10. The vulnerability affects versions before 2.9.7, but the target is version 2.9.10 which already contains the upstream fix. The dangerous BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, etc.) are blacklisted in SubTypeValidator.java and actively blocked during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in version 2.9.7 (Sept 2018), well before version 2.9.10 (Sept 2019).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.9.10. The vulnerability affects versions before 2.9.7, but the target is version 2.9.10 which already contains the upstream fix. The dangerous BlazeDS classes (flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, etc.) are blacklisted in SubTypeValidator.java and actively blocked during polymorphic deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in version 2.9.7 (Sept 2018), well before version 2.9.10 (Sept 2019).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can be exploited for XXE attacks. The target already contains the upstream fix that blacklists these classes in SubTypeValidator.java:72-75. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10 release before TuxCare's onboarding, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability concerns polymorphic deserialization of four dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can be exploited for XXE attacks. The target already contains the upstream fix that blacklists these classes in SubTypeValidator.java:72-75. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10 release before TuxCare's onboarding, making this an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.10-tuxcare.3 is not affected by CVE-2018-14721. The upstream fix (commit 87d29af25e) that adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the polymorphic deserialization blacklist was already present in the upstream 2.9.10 release before TuxCare onboarded it. The blacklist is enforced via SubTypeValidator.validateSubType() which is called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "The target jackson-databind 2.9.10-tuxcare.3 is not affected by CVE-2018-14721. The upstream fix (commit 87d29af25e) that adds org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl to the polymorphic deserialization blacklist was already present in the upstream 2.9.10 release before TuxCare onboarded it. The blacklist is enforced via SubTypeValidator.validateSubType() which is called during bean deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. The target repository is version 2.9.10, which includes the upstream fix committed by Tatu Saloranta (72cd4025a2) that adds this class to the deserialization blocklist. The fix was already present in the upstream 2.9.10 release when TuxCare onboarded it, making this an upstream-provided defense rather than a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to failure to block org.apache.axis2.transport.jms.JMSOutTransportInfo from polymorphic deserialization. The target repository is version 2.9.10, which includes the upstream fix committed by Tatu Saloranta (72cd4025a2) that adds this class to the deserialization blocklist. The fix was already present in the upstream 2.9.10 release when TuxCare onboarded it, making this an upstream-provided defense rather than a TuxCare backport. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 concerns the absence of OpenJPA classes in jackson-databind's polymorphic deserialization blocklist. The target repository (jackson-databind 2.9.10-tuxcare.4) is NOT vulnerable because the upstream fix was already included in the 2.9.10 release. The fix commit (72cd4025a2) added org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.8 (Dec 2018), well before the 2.9.10 release that TuxCare onboarded. The CVE explicitly states \"before 2.9.8\" as the affected range, confirming 2.9.10 is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 concerns the absence of OpenJPA classes in jackson-databind's polymorphic deserialization blocklist. The target repository (jackson-databind 2.9.10-tuxcare.4) is NOT vulnerable because the upstream fix was already included in the 2.9.10 release. The fix commit (72cd4025a2) added org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java. This fix was authored by upstream maintainer Tatu Saloranta and shipped in jackson-databind 2.9.8 (Dec 2018), well before the 2.9.10 release that TuxCare onboarded. The CVE explicitly states \"before 2.9.8\" as the affected range, confirming 2.9.10 is not vulnerable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 does not affect jackson-databind 2.9.10-tuxcare.3. The vulnerability affects \"2.x before 2.9.8\" and the fix (blocking org.jboss.util.propertyeditor.DocumentEditor and related classes from polymorphic deserialization) was already present in the upstream 2.9.10 release that TuxCare onboarded. The fix was committed upstream on 2018-11-19 by Tatu Saloranta (commit 72cd4025a2) and is active in the current version's deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 does not affect jackson-databind 2.9.10-tuxcare.3. The vulnerability affects \"2.x before 2.9.8\" and the fix (blocking org.jboss.util.propertyeditor.DocumentEditor and related classes from polymorphic deserialization) was already present in the upstream 2.9.10 release that TuxCare onboarded. The fix was committed upstream on 2018-11-19 by Tatu Saloranta (commit 72cd4025a2) and is active in the current version's deserialization path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind version 2.9.10 is NOT AFFECTED by CVE-2018-5968. The vulnerability affects versions through 2.8.11 and 2.9.x through 2.9.3. The fix was introduced in upstream versions 2.8.11.1 and 2.9.4 (commit 038b471e2e, January 2018), which added two gadget classes to the deserialization blacklist: org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory. Since the target is version 2.9.10, it inherited the fix from upstream release 2.9.4. The fix commit was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.9.10.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "The target jackson-databind version 2.9.10 is NOT AFFECTED by CVE-2018-5968. The vulnerability affects versions through 2.8.11 and 2.9.x through 2.9.3. The fix was introduced in upstream versions 2.8.11.1 and 2.9.4 (commit 038b471e2e, January 2018), which added two gadget classes to the deserialization blacklist: org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory. Since the target is version 2.9.10, it inherited the fix from upstream release 2.9.4. The fix commit was authored by upstream maintainer Tatu Saloranta and was already present when TuxCare onboarded version 2.9.10.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 fix is present in the target. The upstream vendor (FasterXML) fixed this vulnerability in jackson-databind 2.9.5 (commit 6799f8f10c, Feb 2018) by adding pattern-based blocking of c3p0 DataSource classes in SubTypeValidator.java. The target version 2.9.10 includes this fix from the upstream release that TuxCare onboarded. The defensive code is present at SubTypeValidator.java:213-223, blocking deserialization of any class in com.mchange.v2.c3p0.* ending with \"DataSource\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 fix is present in the target. The upstream vendor (FasterXML) fixed this vulnerability in jackson-databind 2.9.5 (commit 6799f8f10c, Feb 2018) by adding pattern-based blocking of c3p0 DataSource classes in SubTypeValidator.java. The target version 2.9.10 includes this fix from the upstream release that TuxCare onboarded. The defensive code is present at SubTypeValidator.java:213-223, blocking deserialization of any class in com.mchange.v2.c3p0.* ending with \"DataSource\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.10-tuxcare.4) is NOT AFFECTED by CVE-2019-12086. The vulnerability required a missing blocklist entry for \"com.mysql.cj.jdbc.admin.MiniAdmin\" in SubTypeValidator to allow polymorphic deserialization attacks. The upstream vendor (FasterXML) fixed this in version 2.9.9 by adding the class to DEFAULT_NO_DESER_CLASS_NAMES. Since TuxCare onboarded version 2.9.10 (which includes 2.9.9's fixes), the target inherited this upstream fix. The blocklist entry is present at SubTypeValidator.java:84 and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.10-tuxcare.4) is NOT AFFECTED by CVE-2019-12086. The vulnerability required a missing blocklist entry for \"com.mysql.cj.jdbc.admin.MiniAdmin\" in SubTypeValidator to allow polymorphic deserialization attacks. The upstream vendor (FasterXML) fixed this in version 2.9.9 by adding the class to DEFAULT_NO_DESER_CLASS_NAMES. Since TuxCare onboarded version 2.9.10 (which includes 2.9.9's fixes), the target inherited this upstream fix. The blocklist entry is present at SubTypeValidator.java:84 and is actively enforced during bean deserialization via BeanDeserializerFactory._validateSubType().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability involves polymorphic deserialization of the dangerous class `ch.qos.logback.core.db.DriverManagerConnectionSource`, which could lead to remote code execution. The fix blocking this class was authored by upstream maintainer Tatu Saloranta in commit c9ef4a10d6f and shipped in upstream version 2.9.10, which TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12384 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability involves polymorphic deserialization of the dangerous class `ch.qos.logback.core.db.DriverManagerConnectionSource`, which could lead to remote code execution. The fix blocking this class was authored by upstream maintainer Tatu Saloranta in commit c9ef4a10d6f and shipped in upstream version 2.9.10, which TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability allowed arbitrary file read via polymorphic deserialization of JDOM XSLTransformer classes when Default Typing is enabled. The fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was authored ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12814 is NOT present in jackson-databind 2.9.10-tuxcare.3. The vulnerability allowed arbitrary file read via polymorphic deserialization of JDOM XSLTransformer classes when Default Typing is enabled. The fix (commit 5f7c69bba0) added org.jdom.transform.XSLTransformer and org.jdom2.transform.XSLTransformer to the deserialization blocklist in SubTypeValidator.java. This fix was authored ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14379 does not affect jackson-databind 2.9.10-tuxcare.3. The vulnerability involves deserialization of the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream FasterXML project fixed this in version 2.9.9.2 by adding this class to the SubTypeValidator blocklist. Since the target is version 2.9.10 (which is > 2.9.9.2), the fix was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java lines 94-95, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "impact_statement": "CVE-2019-14379 does not affect jackson-databind 2.9.10-tuxcare.3. The vulnerability involves deserialization of the dangerous class net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup when default typing is enabled. The upstream FasterXML project fixed this in version 2.9.9.2 by adding this class to the SubTypeValidator blocklist. Since the target is version 2.9.10 (which is > 2.9.9.2), the fix was already present in the upstream release that TuxCare onboarded. The blocklist entry exists at SubTypeValidator.java lines 94-95, preventing deserialization of this dangerous class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 due to missing blacklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that enable polymorphic typing deserialization attacks. The target repository (jackson-databind 2.9.10-tuxcare.3) contains the upstream fix from commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b authored by Tatu Saloranta. This fix was already present in the upstream version 2.9.10 that TuxCare onboarded. The vulnerable code pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "impact_statement": "CVE-2019-14439 affects jackson-databind versions before 2.9.9.2 due to missing blacklist entries for dangerous classes (ch.qos.logback.core.db.JNDIConnectionSource and net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) that enable polymorphic typing deserialization attacks. The target repository (jackson-databind 2.9.10-tuxcare.3) contains the upstream fix from commit ad418eeb974e357f2797aef64aa0e3ffaaa6125b authored by Tatu Saloranta. This fix was already present in the upstream version 2.9.10 that TuxCare onboarded. The vulnerable code pattern (missing blacklist entries) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9.2), Snyk (>= 2.9.0, < 2.9.9.2; >= 2.8.0, < 2.8.11.4; < 2.7.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 affects jackson-databind before 2.9.10 due to polymorphic deserialization of HikariCP configuration classes (com.zaxxer.hikari.HikariConfig and HikariDataSource). The target version 2.9.10-tuxcare.4 is NOT affected because the upstream fix was already present in the 2.9.10 release that TuxCare onboarded. The fix adds these classes to SubTypeValidator's deserialization blacklist (lines 100-103), preventing the vulnerability. Both fix commits (d4983c740f, 73c1c2cc76) are authored by upstream FasterXML maintainer Tatu Saloranta and are ancestors of the TuxCare onboarding commit, confirming they shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "CVE-2019-14540 affects jackson-databind before 2.9.10 due to polymorphic deserialization of HikariCP configuration classes (com.zaxxer.hikari.HikariConfig and HikariDataSource). The target version 2.9.10-tuxcare.4 is NOT affected because the upstream fix was already present in the 2.9.10 release that TuxCare onboarded. The fix adds these classes to SubTypeValidator's deserialization blacklist (lines 100-103), preventing the vulnerability. Both fix commits (d4983c740f, 73c1c2cc76) are authored by upstream FasterXML maintainer Tatu Saloranta and are ancestors of the TuxCare onboarding commit, confirming they shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-16335 affects jackson-databind versions before 2.9.10 due to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariDataSource. The target repository is jackson-databind version 2.9.10-tuxcare.4, which already contains the upstream fix. The fix was shipped in the upstream 2.9.10 release (commit 73c1c2cc76e by Tatu Saloranta) before TuxCare onboarded the version. The vulnerable code pattern is not present in the target because the upstream fix added \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator blacklist, blocking deserialization of this gadget type.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "CVE-2019-16335 affects jackson-databind versions before 2.9.10 due to unsafe polymorphic deserialization of com.zaxxer.hikari.HikariDataSource. The target repository is jackson-databind version 2.9.10-tuxcare.4, which already contains the upstream fix. The fix was shipped in the upstream 2.9.10 release (commit 73c1c2cc76e by Tatu Saloranta) before TuxCare onboarded the version. The vulnerable code pattern is not present in the target because the upstream fix added \"com.zaxxer.hikari.HikariDataSource\" to the SubTypeValidator blacklist, blocking deserialization of this gadget type.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (>= 2.9.0, < 2.9.10; >= 2.7.0, < 2.8.11.5; < 2.6.7.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16942"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-17267 addresses a polymorphic deserialization vulnerability in jackson-databind related to the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87) adds this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10 release. The target repository (jackson-databind 2.9.10-tuxcare.3) inherited this fix when TuxCare onboarded version 2.9.10. The blacklist entry is present at SubTypeValidator.java:95 and is enforced on the deserialization path via BeanDeserializerFactory. The vulnerable code pattern (missing blacklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "CVE-2019-17267 addresses a polymorphic deserialization vulnerability in jackson-databind related to the gadget class net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. The upstream fix (commit 191a4cdf87) adds this class to the SubTypeValidator blacklist, preventing its deserialization. This fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.10 release. The target repository (jackson-databind 2.9.10-tuxcare.3) inherited this fix when TuxCare onboarded version 2.9.10. The blacklist entry is present at SubTypeValidator.java:95 and is enforced on the deserialization path via BeanDeserializerFactory. The vulnerable code pattern (missing blacklist entry) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.10; < 2.8.11.5), NVD (>= 2.0.0, < 2.8.11.5; >= 2.9.0, < 2.9.10), Snyk (< 2.9.10)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-17531"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:31:03.558530+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-20330"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10650"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T10:29:13.238602+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:31:08.868907+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10673"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:32:00.076980+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10969"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:31:20.489041+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11111"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:49.805924+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11112"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:32:00.076980+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11113"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:58.563217+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-11619"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T10:29:02.723317+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14060"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14061"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14062"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:31:20.489041+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      },
      "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:58.563217+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-8840"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:31:20.489041+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9546"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:31:28.995098+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9547"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T10:29:02.723317+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.10-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:32:00.076980+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54518"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.10 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records, which did not exist when this version was released (September 2019). Java Records were introduced in JDK 14 (March 2020) and finalized in JDK 16 (March 2021). The target has zero Record API usages, no Record-specific code paths, and no JDK14+ source directories. For regular POJOs, @JsonIgnore proper...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.10 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records, which did not exist when this version was released (September 2019). Java Records were introduced in JDK 14 (March 2020) and finalized in JDK 16 (March 2021). The target has zero Record API usages, no Record-specific code paths, and no JDK14+ source directories. For regular POJOs, @JsonIgnore proper..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 does not affect version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-83557 targets DefaultBaseTypeLimitingValidator (a PolymorphicTypeValidator that validates base types for @JsonTypeInfo) which is missing java.lang.Comparable from its UNSAFE set. This class does not exist in jackson-databind 2.9.10. The PolymorphicTypeValidator architecture was introduced in 2.10+, and DefaultBaseTypeLimitingValidator was backported to 2.11+ only. TuxCare's backport pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-83557 targets DefaultBaseTypeLimitingValidator (a PolymorphicTypeValidator that validates base types for @JsonTypeInfo) which is missing java.lang.Comparable from its UNSAFE set. This class does not exist in jackson-databind 2.9.10. The PolymorphicTypeValidator architecture was introduced in 2.10+, and DefaultBaseTypeLimitingValidator was backported to 2.11+ only. TuxCare's backport pa..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10-tuxcare.6 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T14:30:24.319521+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}